use AccessController.doPrivileged to create classloader