Principal is not replicated

[jzwadowski]

Tomcat store Principal in the session object. Although it is said in StandardSession:

/**
* The authenticated Principal associated with this session, if any.
* IMPLEMENTATION NOTE: This object is not saved and
* restored across session serializations!
*/
protected transient Principal principal = null;

but Request method getUserPrincipal or getRemoteUser takes principal from field which is set inside AuthenticatorBase.

        Principal principal = request.getUserPrincipal();
        if (principal == null) {
            Session session = request.getSessionInternal(false);
            if (session != null) {
                principal = session.getPrincipal();
                if (principal != null) {
                    if (log.isDebugEnabled()) {
                        log.debug("We have cached auth type " + session.getAuthType() +
                                " for principal " + principal);
                    }
                    request.setAuthType(session.getAuthType());
                    request.setUserPrincipal(principal);
                }
            }
        }

I suggest that userPrincipal and authType should be replicated