I think the propagation of security context and its integration with CDI is not defined anywhere (correct me if I am wrong) so it's questionable whether we want to introduce some custom nonportable implementation. Setting as "unscheduled" for now.