SecurityContext#getUserPrincipal returns null when not authenticated, not a default user