Fixed doGetAuthorizationInfo() to return null only if there's no associated user for the principal id - as indicated in the Shiro javadocs.