killbill-uncached

diff --git a/util/src/main/java/org/killbill/billing/util/security/api/DefaultSecurityApi.java b/util/src/main/java/org/killbill/billing/util/security/api/DefaultSecurityApi.java
index a699084..5d0bc2b 100644
--- a/util/src/main/java/org/killbill/billing/util/security/api/DefaultSecurityApi.java
+++ b/util/src/main/java/org/killbill/billing/util/security/api/DefaultSecurityApi.java
@@ -40,9 +40,16 @@ public class DefaultSecurityApi implements SecurityApi {
     private static final String[] allPermissions = new String[Permission.values().length];
 
     @Override
-    public void login(final Object principal, final Object credentials) {
+    public synchronized void login(final Object principal, final Object credentials) {
         final Subject currentUser = SecurityUtils.getSubject();
 
+        // Workaround for https://issues.apache.org/jira/browse/SHIRO-510
+        // TODO Not sure if it's a good fix?
+        if (principal.equals(currentUser.getPrincipal()) &&
+            currentUser.isAuthenticated()) {
+            return;
+        }
+
         // UsernamePasswordToken is hardcoded in AuthenticatingRealm
         if (principal instanceof String && credentials instanceof String) {
             currentUser.login(new UsernamePasswordToken((String) principal, (String) credentials));