It's happening in the standalone and in the WAR case (Tomcat V8). The code is running without security manager.
To reproduce you have to sign the jar which contains the classes under test.