Test that the caller's security identity is propagated by default
(when neither run-as identity, nor security-identity is specified)