calling httpServletRequest.getPrincipal().getName() does not return the user's name...

[danhaywood]

... because PrincipalForApplicationUser does not actually implement java.security.Principal, only Shiro's AuthorizationInfo and AuthenticationInfo interfaces.

This means that Shiro wraps it in an internal ObjectPrincipal. The getName() of ObjectPrincipal delegates to PrincipalForApplicationUser's toString() ... because so far a Shiro is concerned, it's just a java.lang.Object and there's nothing else to call.

Probably we should make our PrincipalForApplicationUser implement java.security.Principal, but that might introduce some regressions. For now, suggest simply ensuring that toString() returns the principal name, to fix the immediate issue.