Implementing SecurityService without ThreadLocal to use with Kotlin coroutine

Somewhat related to this:

We are trying to inject a SecurityService bean so that I can access the authentication object outside of a controller. Unfortunately, like the previous RequestScope implementation, the DefaultSecurityService implementation of getAuthentication relies on the ServerRequestContext.currentRequest() which is using ThreadLocal:

@Override
public Optional<Authentication> getAuthentication() {
    return ServerRequestContext.currentRequest()
            .flatMap(request -> request.getUserPrincipal(Authentication.class));
}

And since we're also using Kotlin coroutines, we want to find a way of implementing getAuthentication without ThreadLocal. Any suggestions on how we can go about doing that?