主体是会话作用域的.确保第二个请求被映射/使用相同的会话(使用JSESSIONID).

Principal in Servlet 3.0 is session scoped. Make sure the second request is mapped/using the same session (use the JSESSIONID).