LPS-39810 Don't depend on ThreadLocal

This was breaking tests because it was not initialized but this is something that could happen to clients of this API and since it's not necessary it's not a good idea to use ThreadLocal.
LPS-39810 Source formatting
LPS-40088 PACL - avoid double permission checking on PortalPolicy failures
LPS-39810 SF