I really don't like these static lookups. I am not going to hold the PR up over it, but it would be better to inject the security domain service and get this information from there, that way it is obvious that dependencies are being respected. 

Also there is this, but it is not really related:
https://issues.jboss.org/browse/SECURITY-767