Synchronized in SecurityHelper.runAsUser and runAsAnonymous