Use only Subject to check permissions, not SecurityManager

I changed the auth strategy to only use the Subject to check permissions - asking the SecurityManager itself is not necessary.

By using only the Subject testing is simplified, because only the subject needs to be mocked.

This is the fix for the 1.4 branch.