UF-84: JAASAuthenticationService may leak logged-in users across unrelated requests: context switch between thread and http session credentials