initializeFilter();

        // Test request without Authorization header should challenge client
        when(request.getHeader("Authorization")).thenReturn(null);
        when(httpSession.getAttribute("NtlmHttpAuth")).thenReturn(null);

        filter.doFilter(request, response, filterChain);

        verify(response).setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        verify(response).setHeader("WWW-Authenticate", "NTLM");

                return null;
            }
            req.getSession().setAttribute("NtlmHttpAuth", ntlm);
        } else if (!skipAuthentication) {
            final HttpSession ssn = req.getSession(false);
            if (ssn == null || (ntlm = (NtlmPasswordAuthentication) ssn.getAttribute("NtlmHttpAuth")) == null) {
                resp.setHeader("WWW-Authenticate", "NTLM");
                if (offerBasic) {

                return null;
            }
            req.getSession().setAttribute("NtlmHttpAuth", ntlm);
        } else if (!skipAuthentication) {
            final HttpSession ssn = req.getSession(false);
            if (ssn == null || (ntlm = (NtlmPasswordAuthentication) ssn.getAttribute("NtlmHttpAuth")) == null) {
                resp.setHeader("WWW-Authenticate", "NTLM");
                if (offerBasic) {

            ntlmServlet.service(request, response);

            // Verify that user information is stored in the session
            verify(session).setAttribute("NtlmHttpAuth", ntlmAuth);
            verify(session).setAttribute("ntlmuser", "user");
            verify(session).setAttribute("ntlmdomain", "TEST_DOMAIN");

            // Verify that the chain continues