Should it do something to invoke $authz.getPrincipal() in *.vm?
Where is the $authz initialized?