xacml-authz-filter: authentication data is taken from Principal object; access is allowed only if XACML decision is PERMIT.