Do Authentication objects need to be immutable?

Do Authentication objects need to be immutable?

RunAsUserToken claims that it is. What about the others?

What are the consequences, if they weren't?

Thanks.

Andreas

No, they don't need to be immutable. Using immutable objects simply protects an object from inadvertant modification.