this only occurs if the user has installed a custom javax.security.auth.Policy (which is deprecated), and has a custom class loader that creates ProtectionDomains with null PermissionCollections.