@Test
public void testStartAppSession() {

    LOG.info("testStartAppSession");
    Mockito.when(httpServletRequest.getSession()).thenReturn(httpSession);
    Mockito.when(httpServletRequest.getSession(false)).thenReturn(httpSession);
    // Creating a new session must invalidate the old session, hence we have to expect this call.
    Mockito.doNothing().when(httpSession).invalidate();
    // A successfully created session must carry the reference session ID.
    assertThat(impl.startAppSession(principal), is(REFERENCE_SESSION_ID));
    // Check that the session carries the session data.
    verify(httpSession).setAttribute(eq(SESSION_DATA_KEY), anyObject());
    // Check that the existing session was invalidated.
    verify(httpSession).invalidate();
    @Nullable final SecurityContext securityContext =
            SessionManager.createSecurityContextForSession(httpServletRequest);
    // Check that the authentication scheme matches the type of session that was intended to be created.
    assert securityContext != null;
    assertThat(securityContext.getAuthenticationScheme(), is(SessionManager.AUTHENTICATION_SCHEME_APPTOKEN));
    // Check that the session carries the Identity ID of the authenticated user for which the session was established.
    @Nullable final Principal principal = securityContext.getUserPrincipal();
    assertThat(principal, is(notNullValue()));
    assertThat(principal.getName(), is(REFERENCE_PERSON_ID));
}