SecurityAssociation.getCallerPrincipal needs to return the principal from the security context
Also setPrincipal and setCredential needs to be verified.