The gatekeeper seems to ensure that the session is not null. The thrown UnauthorizedAccessException is tested in the IFEPATest.java page