Subject subject = SecurityUtils.getSubject();
AuthenticationToken authenticationToken = new UsernamePasswordToken(user.getUsername(), user.getPassword());
//--这一步认证里,authenticationToken被放入了session的哪个属性里？
subject.login(authenticationToken);