Is the Userprincipal I retrieve from SecurityContextHolder bound to requests or to sessions?
UserPrincipal principal = (UserPrincipal) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
This is the way I access the currently logged in user. Will this invalidate if the current session is destroyed?