code: public static @Nonnull Authentication getAuthentication() {
          Authentication a = SecurityContextHolder.getContext().getAuthentication();
          // on Tomcat while serving the login page, this is null despite the fact
          // that we have filters. Looking at the stack trace, Tomcat doesn't seem to
          // run the request through filters when this is the login request.
          // see http://www.nabble.com/Matrix-authorization-problem-tp14602081p14886312.html
          if(a==null)
              a = ANONYMOUS;
          return a;
      }
docs: Gets the {@link Authentication} object that represents the user
  associated with the current request.