Yang: for multi-thread envrionment, we need to set Auth object to ThreadLocal every time.