Client was relying on 'principal' in session rather than 'currentPrincipal'