SEC-1325: Tighten up Authentication interface contract to disallow null authorities. Modified internals of AbstractAuthenticationToken to use an empty list instead of null. Clarified Javadoc. removed unnecessary null checks in classes which use the interface.

taglibs/src/main/java/org/springframework/security/taglibs/authz/LegacyAuthorizeTag.java

@@ -125,10 +125,6 @@ public class LegacyAuthorizeTag extends TagSupport {
             return Collections.emptyList();
         }
 
-        if ((null == currentUser.getAuthorities())) {
-            return Collections.emptyList();
-        }
-
         return currentUser.getAuthorities();
     }