static final boolean org.apache.jasper.Constants.IS_SECURITY_ENABLED results in erroneous state when security is enabled dynamically

1) start app server normally (no security)
2) assuming any normal webapp is initialized, a JspRuntimeContext will be created and at first invocation

Constants.IS_SECURITY_ENABLED = (System.getSecurityManager() != null);

is evaluated.

3) deploy some later component (ie. a webapp) which does:

System.setSecurityManager(new SecurityManager());

4) from that point, all Jasper code will provide the incorrect security state, app server wide
#### Environment
Any