merge SecurityContext and Holder