This was added so that different SecurityContext implementations could be provided - however it has ended up making some assumptions regarding what needs to be provided to a SecurityContext implementation where the point of having different implementations is that they may have very different needs.

Instead just ensure SecurityContextInitial has a suitable method that can be overridden - maybe using a common base abstract class.