Decoupled the AuthPolicyValidatingInterceptor from the STSTokenValidator. Also create a security context with the principal