disabled session creation in .JSP pages and added a more elegant way to inject the current Spring Security principal.