UserContext would be the one to worry about security on.  Although as Rafal said, spring lets you get around almost anything.