public function onKernelRequest(GetResponseEvent $event)
    {
        $request = $event->getRequest();
        // Ignore sub-requests, including fragments.
        if (!$this->isMasterRequest($request, $event->getRequestType())) {
            return;
        }

        $siteAccess = $request->attributes->get('siteaccess');
        if (!$siteAccess instanceof SiteAccess) {
            return;
        }

        $token = $this->tokenStorage->getToken();
        if ($token === null) {
            return;
        }

        if (
            // Leave access to login route, so that user can attempt re-authentication.
            $request->attributes->get('_route') !== 'login'
            && !$this->hasAccess($siteAccess, $token->getUsername())
        ) {
            throw new UnauthorizedSiteAccessException($siteAccess, $token->getUsername());
        }
    }