Index: security-spi/common/src/main/java/org/jboss/security/PicketBoxLogger.java
===================================================================
--- security-spi/common/src/main/java/org/jboss/security/PicketBoxLogger.java	(revision 444)
+++ security-spi/common/src/main/java/org/jboss/security/PicketBoxLogger.java	(working copy)
@@ -688,4 +688,7 @@
     @Message(id = 366, value = "Error parsing time out number.")
     void errorParsingTimeoutNumber();
 
-}
\ No newline at end of file
+    @LogMessage(level = Logger.Level.ERROR)
+    @Message(id = 367, value = "Failed to find constructor for default security context class %s")
+    void failedToFindConstructorForDefaultSecurityContextClass(Class defaultSecurityContextClass, @Cause Exception e);
+}
Index: security-spi/spi/src/main/java/org/jboss/security/SecuritySPIActions.java
===================================================================
--- security-spi/spi/src/main/java/org/jboss/security/SecuritySPIActions.java	(revision 444)
+++ security-spi/spi/src/main/java/org/jboss/security/SecuritySPIActions.java	(working copy)
@@ -31,26 +31,39 @@
  *  @version $Revision$
  */
 class SecuritySPIActions
-{  
+{
+
+    public static final PrivilegedAction<ClassLoader> GET_CONTEXT_CLASS_LOADER = new PrivilegedAction<ClassLoader>()
+    {
+        public ClassLoader run()
+        {
+            return Thread.currentThread().getContextClassLoader();
+        }
+    };
+
    static ClassLoader getContextClassLoader()
    {
-      return AccessController.doPrivileged(new PrivilegedAction<ClassLoader>() 
+      if(System.getSecurityManager() == null) {
+        return Thread.currentThread().getContextClassLoader();
+      } else
       {
-         public ClassLoader run()
-         {
-           return Thread.currentThread().getContextClassLoader();
-         }
-      });
+        return AccessController.doPrivileged(GET_CONTEXT_CLASS_LOADER);
+      }
    }
    
    static ClassLoader getCurrentClassLoader(final Class clazz)
    {
-      return AccessController.doPrivileged(new PrivilegedAction<ClassLoader>()
+      if(System.getSecurityManager() == null) {
+          return clazz.getClassLoader();
+      } else
       {
-         public ClassLoader run()
-         {
-            return clazz.getClassLoader();
-         }
-      });
+          return AccessController.doPrivileged(new PrivilegedAction<ClassLoader>()
+          {
+             public ClassLoader run()
+             {
+                return clazz.getClassLoader();
+             }
+          });
+      }
    }
-}
\ No newline at end of file
+}
Index: security-spi/spi/src/main/java/org/jboss/security/SecurityContextFactory.java
===================================================================
--- security-spi/spi/src/main/java/org/jboss/security/SecurityContextFactory.java	(revision 444)
+++ security-spi/spi/src/main/java/org/jboss/security/SecurityContextFactory.java	(working copy)
@@ -35,13 +35,18 @@
  */
 @SuppressWarnings("unchecked")
 public class SecurityContextFactory
-{      
-   private static String defaultFQN = "org.jboss.security.plugins.JBossSecurityContext";
+{
+    private static final Class[] CONSTRUCTOR_TYPES = new Class[]{String.class};
+    public static final Class[] SECURITY_CONTEXT_UTIL_PARAMETER_TYPES = new Class[]{SecurityContext.class};
+
+    private static String defaultFQN = "org.jboss.security.plugins.JBossSecurityContext";
    
    private static String defaultUtilClassFQN = "org.jboss.security.plugins.JBossSecurityContextUtil";
    
    private static Class<? extends SecurityContext> defaultSecurityContextClass = null;
+   private static Constructor<SecurityContext> defaultSecurityContextConstructor = null;
    private static Class<? extends SecurityContextUtil> defaultUtilClass = null;
+   private static Constructor<SecurityContextUtil> defaultUtilConstructor = null;
    
    /**
     * Classloader.loadClass is a synchronized method in the JDK. Under heavy concurrent requests,
@@ -77,6 +82,13 @@
          {
          }
       }
+      if(defaultSecurityContextClass != null) {
+          try {
+              defaultSecurityContextConstructor = (Constructor<SecurityContext>) defaultSecurityContextClass.getConstructor(CONSTRUCTOR_TYPES);
+          } catch (Exception e)
+          {
+          }
+      }
    }
 
    /**
@@ -87,12 +99,14 @@
     */
    public static SecurityContext createSecurityContext(String securityDomain) throws Exception
    {
+      if(defaultSecurityContextConstructor != null)
+         return createSecurityContext(securityDomain, defaultSecurityContextConstructor);
       if(defaultSecurityContextClass != null)
-         return createSecurityContext(securityDomain, defaultSecurityContextClass);
+          return createSecurityContext(securityDomain, defaultSecurityContextClass);
       return createSecurityContext(securityDomain, defaultFQN, SecuritySPIActions.getCurrentClassLoader(SecurityContextFactory.class));
    }
-   
-   /**
+
+    /**
     * Create a security context 
     * @param securityDomain Security Domain driving the context
     * @param classLoader ClassLoader to use
@@ -101,6 +115,8 @@
     */
    public static SecurityContext createSecurityContext(String securityDomain, ClassLoader classLoader) throws Exception
    {
+      if(defaultSecurityContextConstructor != null)
+         return createSecurityContext(securityDomain, defaultSecurityContextConstructor);
       if(defaultSecurityContextClass != null)
          return createSecurityContext(securityDomain, defaultSecurityContextClass);
       return createSecurityContext(securityDomain, defaultFQN, classLoader);
@@ -135,7 +151,8 @@
       if(fqnClass == null)
          throw PicketBoxMessages.MESSAGES.invalidNullArgument("fqnClass");
       defaultSecurityContextClass = getContextClass(fqnClass, classLoader);
-      return createSecurityContext(securityDomain, defaultSecurityContextClass);
+      defaultSecurityContextConstructor = (Constructor<SecurityContext>) defaultSecurityContextClass.getConstructor(CONSTRUCTOR_TYPES);
+      return createSecurityContext(securityDomain, defaultSecurityContextConstructor);
    }
    
    
@@ -156,9 +173,19 @@
        if(clazz == null)
          throw PicketBoxMessages.MESSAGES.invalidNullArgument("clazz");
       //Get the CTR
-      Constructor<? extends SecurityContext> ctr = clazz.getConstructor(new Class[]{String.class});
-      return (SecurityContext) ctr.newInstance(new Object[]{securityDomain}); 
+      Constructor<? extends SecurityContext> ctr = clazz.getConstructor(CONSTRUCTOR_TYPES);
+      return (SecurityContext) ctr.newInstance(securityDomain);
    }
+
+
+   private static SecurityContext createSecurityContext(String securityDomain, Constructor<SecurityContext> constructor) throws Exception
+   {
+       if(securityDomain == null)
+           throw PicketBoxMessages.MESSAGES.invalidNullArgument("security domain");
+       if(constructor == null)
+           throw PicketBoxMessages.MESSAGES.invalidNullArgument("constructor");
+       return (SecurityContext) constructor.newInstance(securityDomain);
+   }
    
    /**
     * Create a security context
@@ -223,6 +250,10 @@
     */
    public static SecurityContextUtil createUtil(SecurityContext sc) throws Exception
    {
+      Constructor<SecurityContextUtil> ctr = defaultUtilConstructor;
+      if(ctr != null) {
+          return ctr.newInstance(sc);
+      }
       return createUtil(sc, SecuritySPIActions.getCurrentClassLoader(SecurityContextFactory.class));
    }
    
@@ -234,18 +265,17 @@
     */
    public static SecurityContextUtil createUtil(SecurityContext sc, ClassLoader classLoader) throws Exception
    {
-      Class<? extends SecurityContextUtil> clazz = defaultUtilClass;
+
+      Constructor<SecurityContextUtil> ctr = defaultUtilConstructor;
       
-      if(clazz  == null)
+      if(ctr  == null)
       {
-         clazz = (Class<? extends SecurityContextUtil>) loadClass(defaultUtilClassFQN, classLoader);
-         defaultUtilClass = clazz; 
+         Class<? extends SecurityContextUtil> clazz = (Class<? extends SecurityContextUtil>) loadClass(defaultUtilClassFQN, classLoader);
+         defaultUtilClass = clazz;
+         ctr = defaultUtilConstructor = (Constructor<SecurityContextUtil>) clazz.getConstructor(SECURITY_CONTEXT_UTIL_PARAMETER_TYPES);
       }
       
-      //Get the CTR
-      Constructor<?> ctr = clazz.getConstructor(new Class[]{SecurityContext.class});
-      Object obj = ctr.newInstance(new Object[]{sc});
-      return SecurityContextUtil.class.cast(obj);
+      return ctr.newInstance(sc);
    }
    
    /**
@@ -316,6 +346,7 @@
    {
       defaultUtilClassFQN = fqn;
       defaultUtilClass = null; //reset
+      defaultUtilConstructor = null;
    }
    
    /**
@@ -350,4 +381,4 @@
          return (Class<SecurityContext>) tcl.loadClass(className);
       }
    }
-}
\ No newline at end of file
+}
