"this.credentials.getRequest().getUserPrincipal()" is called in at least three places.
...maybe an opportunity for factoring it out into its own (NPE-safe) method?