We have to move all this code over to the (new) SecurityPortletContainerWrapper so that it always takes place on the MPI (Main Portal Instance) when resiliency framework is enabled.

It's too costly to perform these checks on the SPI (Slave Portal Instance) if there is a chance that the operation (render/action/resource/event) will not happen.

/cc @shuyangzhou