bugfix: user attributes are retrieved from HttpServletRequest with getAttribute() method