eliminated redundant check --- let the caller do it.

git-svn-id: https://hudson.dev.java.net/svn/hudson/trunk/hudson/main@26475 71c3de6d-444a-0410-be80-ed276b4c234a

core/src/main/java/hudson/security/BasicAuthenticationFilter.java

@@ -25,6 +25,7 @@ package hudson.security;
 
 import hudson.model.Hudson;
 import hudson.util.Scrambler;
+import org.acegisecurity.Authentication;
 import org.acegisecurity.GrantedAuthorityImpl;
 import org.acegisecurity.context.SecurityContextHolder;
 import org.kohsuke.stapler.StaplerRequest;
@@ -106,7 +107,7 @@ public class BasicAuthenticationFilter implements Filter {
                 // to Acegi. For anonymous users that doesn't have user principal,
                 // AnonymousProcessingFilter that follows this should create
                 // an Authentication object.
-                SecurityContextHolder.getContext().setAuthentication(ContainerAuthentication.create(req));
+                SecurityContextHolder.getContext().setAuthentication(new ContainerAuthentication(req));
             }
             try {
                 chain.doFilter(request,response);

core/src/main/java/hudson/security/ContainerAuthentication.java

@@ -49,23 +49,15 @@ public final class ContainerAuthentication implements Authentication {
     private final Principal principal;
     private GrantedAuthority[] authorities;
 
-    public static Authentication create(HttpServletRequest request) {
-        Principal p = request.getUserPrincipal();
-        if (p!=null)
-            return new ContainerAuthentication(request);
-        return Hudson.ANONYMOUS;
-    }
-
     /**
      * Servlet container can tie a {@link ServletRequest} to the request handling thread,
      * so we need to capture all the information upfront to allow {@link Authentication}
      * to be passed to other threads, like update center does. See HUDSON-5382. 
-     *
-     * @deprecated as of 1.343
-     *      Use {@link #create(HttpServletRequest)} instead. Will be eventually converted into a private method.
      */
     public ContainerAuthentication(HttpServletRequest request) {
         this.principal = request.getUserPrincipal();
+        if (principal==null)
+            throw new IllegalStateException(); // for anonymous users, we just don't call SecurityContextHolder.getContext().setAuthentication.   
 
         // Servlet API doesn't provide a way to list up all roles the current user
         // has, so we need to ask AuthorizationStrategy what roles it is going to check against.