bugfix: fix login() once again accepts null subject (#2807)

Author: lprimak

core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java

@@ -305,7 +305,7 @@ public Subject login(Subject subject, AuthenticationToken token) throws Authenti
      * @param subject Subject
      */
     protected void beforeSuccessfulLogin(Subject subject) {
-        Session session = subject.getSession(false);
+        Session session = subject != null ? subject.getSession(false) : null;
         if (session != null) {
             Map<Object, Object> attributes = new HashMap<>();
             session.getAttributeKeys().forEach(key -> attributes.put(key, session.getAttribute(key)));