the securityContext will be lost in jsp page when use the spring async controller.

Summary

spring security: 4.1.2.RELEASE

the securityContext will be lost in jsp page when use the spring async controller with callable dispatcher result, and the authorize tag will not work.

Actual Behavior

1. in a spring controller method, return a Callable type to dispatch to a jsp page.
   `
   public Callable list() {

   return () -> {
       //doSomething
       return "jsppage";
   };
   

   }
   `

2. in jsppage, use the authorize tag
   < security:authorize access="hasAuthority('code')" > test < /security:authorize >
   the 'test' will not be show although I login with a user which has the 'code' authority.

3. in fact, the below code in the AbstractAuthorizeTag#authorizeUsingAccessExpression that want to obtain the authentication will return null.
   if (SecurityContextHolder.getContext().getAuthentication() == null) { return false; }

4. The reason of this issue is the page dispatch and render in difference thread that managed by container which without set securityContext.

Expected Behavior

when I use async controller, the jsp tag authorize should be work correctly.

Configuration

Version

spring security: 4.1.2.RELEASE
tomcat: 8.0.30

Sample

Start by reproducing the Callable controller flow with the JSP authorize tag described in the issue, then read AbstractAuthorizeTag#authorizeUsingAccessExpression and the async dispatch path. Confirm that authentication is unavailable during JSP rendering; done means the authorize tag works correctly for an authenticated user with the required authority.