if availablePoliciesStr == "" {
			// all policies presented in the claim should exist
			iamLogIf(GlobalContext, fmt.Errorf("expected policy (%s) missing from the JWT claim %s, rejecting the request", policies, iamPolicyClaimNameOpenID()))

			return false
		}
		combinedPolicy = c
	}

	// 3. If an inline session-policy is present, evaluate it.

	// Now check if we have a sessionPolicy.

 *
 * <h2>More on {@code CacheBuilder}</h2>
 *
 * {@code CacheBuilder} builds caches with any combination of the following features:
 *
 * <ul>
 *   <li>automatic loading of entries into the cache
 *   <li>least-recently-used eviction when a maximum size is exceeded (note that the cache is
 *       divided into segments, each of which does LRU internally)
 *   <li>time-based expiration of entries, measured since last access or last write

 *
 * <h2>More on {@code CacheBuilder}</h2>
 *
 * {@code CacheBuilder} builds caches with any combination of the following features:
 *
 * <ul>
 *   <li>automatic loading of entries into the cache
 *   <li>least-recently-used eviction when a maximum size is exceeded (note that the cache is
 *       divided into segments, each of which does LRU internally)
 *   <li>time-based expiration of entries, measured since last access or last write

    cache.close()
    createNewCacheWithSize(10)
    set("a", "a", "a")
    set("b", "b", "b")
    set("c", "c", "c")
    set("d", "d", "d")
    set("e", "e", "e")
    cache["b"]!!.close() // 'B' is now least recently used.

    // Causing the size to grow to 12 should evict 'A'.
    set("f", "f", "f")
    // Causing the size to grow to 12 should evict 'C'.
    set("g", "g", "g")
    cache.flush()

   * and accesses that were performed on the map. The queue is drained on writes and when it exceeds
   * its capacity threshold.
   *
   * The Least Recently Used page replacement algorithm was chosen due to its simplicity, high hit
   * rate, and ability to be implemented with O(1) time complexity. The initial LRU implementation

   */
  public static CharMatcher isNot(char match) {
    return new IsNot(match);
  }

  /**
   * Returns a {@code char} matcher that matches any BMP character present in the given character
   * sequence. Returns a bogus matcher if the sequence contains supplementary characters.
   */
  public static CharMatcher anyOf(CharSequence sequence) {
    switch (sequence.length()) {

   */
  public static CharMatcher isNot(char match) {
    return new IsNot(match);
  }

  /**
   * Returns a {@code char} matcher that matches any BMP character present in the given character
   * sequence. Returns a bogus matcher if the sequence contains supplementary characters.
   */
  public static CharMatcher anyOf(CharSequence sequence) {
    switch (sequence.length()) {

   *
   * @param collection the collection whose complement should be stored in the enum set
   * @return a new, modifiable {@code EnumSet} containing all values of the enum that aren't present
   *     in the given collection
   * @throws IllegalArgumentException if {@code collection} is not an {@code EnumSet} instance and
   *     contains no elements
   */
  @J2ktIncompatible

   * and accesses that were performed on the map. The queue is drained on writes and when it exceeds
   * its capacity threshold.
   *
   * The Least Recently Used page replacement algorithm was chosen due to its simplicity, high hit
   * rate, and ability to be implemented with O(1) time complexity. The initial LRU implementation

 *  New: Don't fall back to common name (CN) verification for hostnames. This
    behavior was deprecated with RFC 2818 in May 2000 and was recently dropped
    from major web browsers.
 *  New: Honor the `Retry-After` response header. HTTP 503 (Unavailable)
    responses are retried automatically if this header is present and its delay
    is 0 seconds. HTTP 408 (Client Timeout) responses are retried automatically