Always inject anonymous user to security context.
Load principal from database.