Be sure to check your bean validation! If your authorization check lives inside the handler, anything validation does runs before it, under the caller's identity.