JERSEY-2543: ApplicationHandler.apply() always overrides the SecurityContext of the ContainerRequest

Change-Id: Iff4d4e5a2d9cfd081fbe1f38f52769c2bc8c180e
Signed-off-by: Jakub Podlesak <[email protected]>

Author: japod

core-server/src/main/java/org/glassfish/jersey/server/ApplicationHandler.java

@@ -929,7 +929,9 @@ public Future<ContainerResponse> apply(final ContainerRequest request,
         final FutureResponseWriter responseFuture =
                 new FutureResponseWriter(request.getMethod(), outputStream, runtime.getBackgroundScheduler());
 
-        request.setSecurityContext(DEFAULT_SECURITY_CONTEXT);
+        if (request.getSecurityContext() == null) {
+            request.setSecurityContext(DEFAULT_SECURITY_CONTEXT);
+        }
         request.setWriter(responseFuture);
 
         handle(request);