To avoid the potential long delay of waiting for a failing DNS host name
resolution before attempting to fall back to HTTP tunnelling, in default HTTP
proxy fallback mode, RMI makes its first attempt to connect to a host in a
separate thread, while it prepares to make a connection over HTTP. The problem
is that this AsyncConnector thread is created (like all other RMI system
threads) in a privileged block, so it does not inherit the AccessControlContext
of the thread that is really trying to make the connection. Therefore, the
security check for the first RMI call to a given host may succeed when it should
not. Subsequent calls will correctly fail, either creating a new connection to
the same host, or reusing an existing connection to the same host.