LoginContext initializes LoginModules with a Subject only once.
if the login method is called and authentication fails,
it nulls out the Subject and instantiates a new one.

but since the LoginModules are not reinitialized with the new
Subject, they end up operating on the original Subject they were
initialized with, to which the LoginContext no longer has
a reference. thus, the updates will never be seen by the
calling application.