The credential loaders need to be created outside of the realm instance, this way multiple instances can be created with varying settings.

The PrincipalMapping class was only really intended to contain settings required to locate a prinicipal - however this has ended up containing credential loading settings.