ContainerRequestContext abortWith() does not abort

This is my authentication filter:

@Secured
@Provider
@Priority(Priorities.AUTHENTICATION)
public class SecuredFilter implements ContainerRequestFilter {

    @Override
    public void filter(ContainerRequestContext requestContext) {

        String authorizationHeader = requestContext.getHeaderString(HttpHeaders.AUTHORIZATION);
        if (authorizationHeader == null || !authorizationHeader.startsWith("Bearer ")) {
             requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED).build());
        }

        String token = authorizationHeader.substring("Bearer".length()).trim();
        // [...]
        }
}

Why does it not abort and send back the response when the header is missing ? Right now I get an obvious NPE at authorizationHeader.substring ...

The documentation says:

void abortWith(Response response)

Abort the filter chain with a response. This method breaks the filter chain processing and returns the provided response back to the client. The provided response goes through the chain of applicable response filters. Parameters: response - response to be sent back to the client.

What am I missing ?