certain LoginModules may want to enforce security checks
and restrict certain actions depending on the caller.
however, since LoginContext invokes each LoginModule
inside a doPrivileged block, the caller is truncated from
the current ACC.

the LoginContext should store the current ACC in the
LoginModule sharedState variable. therefore, modules
will be able to retrieve the current ACC if necessary.