code: public Principal getUserPrincipal()
      {
          if (_userPrincipal == __NO_USER) return null;
  
          if (_userPrincipal == __NOT_CHECKED)
          {
              _userPrincipal = __NO_USER;
  
              // Try a lazy authentication
              HttpContext context = getHttpResponse().getHttpContext();
              if (context != null)
              {
                  Authenticator auth = context.getAuthenticator();
                  UserRealm realm = context.getRealm();
                  if (realm != null && auth != null)
                  {
                      try
                      {
                          // TODO - should not need to recalculate this!
                          String pathInContext = getPath().substring(
                                  context.getContextPath().length());
                          auth.authenticate(realm, pathInContext, this, null);
                      }
                      catch (Exception e)
                      {
                          LogSupport.ignore(log, e);
                      }
                  }
              }
  
              if (_userPrincipal == __NO_USER) return null;
          }
          return _userPrincipal;
      }
docs: /* ------------------------------------------------------------