Major AbstractSession implementation sometimes uses an internal method isAdministrator() that tests whether the current principal name is 'Administrator' or if it belongs to a group with name 'administrators'.
Performing security checks based on principal names is wrong since principal names can come from external source (such as LDAP or ActiveDirectory server) we have no control on.
Instead we should use permission check that are pluggable thanks to the existing extension point.
