Description
Currently the effective set of principals is calculated during phase 1 (login) both in LoginModuleImpl and TokenLoginModule. having looked at this again, if would make more sense to me to postpone the calculation to phase 2 (commit) and thus to the point where the overall login succeeded.