security issue: removing subject from thread after request handling