code: private SecurityContext getUserContext(final RepositoryObject obj) {
  
  		final String userId = obj.getUserId();
  		Principal principal = null;
  
  		if (userId != null) {
  
  			final App app = StructrApp.getInstance();
  
  			try (final Tx tx = app.tx()) {
  
  				// TODO: change this, userId is currently the name of a user,
  				//       WITHOUT ANY AUTHENTICATION.
  				principal = app.nodeQuery(Principal.class).and(Principal.name, userId).getFirst();
  				tx.success();
  
  			} catch (FrameworkException fex) {
  				logger.warn("", fex);
  			}
  
  		} else {
  
  			System.out.println("Object without userId!");
  		}
  
  		// return user
  		if (principal != null) {
  			return SecurityContext.getInstance(principal, AccessMode.Backend);
  		}
  
  		return SecurityContext.getSuperUserInstance();
  	}
docs: ----- private methods -----