Again, I don't like having the SecurityContext hold onto the session.