fixed code that returned a null subject - Subject should never be null (they can be re-used even after logout - they're just considered anonymous again after that point).