title: Spring security's SecurityContextHolder: session or request bound?
body: <p>Is the Userprincipal I retrieve from <code>SecurityContextHolder</code> bound to requests or to sessions?</p>
  
  <p><code>UserPrincipal principal = (UserPrincipal) SecurityContextHolder.getContext().getAuthentication().getPrincipal();</code></p>
  
  <p>This is the way I access the currently logged in user. Will this invalidate if the current session is destroyed?</p>