non general feature: session manager extracts principal username from
spring security context