My believe, thing over complicated here ... why we have  getEffectiveUser & getRealUser? what kind of security is it? There was getSubject for a long time, why we can't use it?