AbstractSecurityHandler is currently performing authentication for second time.
The HTTP request context already contains Authentication object that can be accessed:
@Override
public Principal authenticate(ContainerRequestContext requestContext) {
Authentication auth = (Authentication)requestContext.getProperty(Authentication.class.getName());
return new SmartHomePrincipal(auth);
}
This will affect subclasses as well.