diff --git a/core/src/main/java/de/ids_mannheim/korap/web/filter/BlockingFilter.java b/core/src/main/java/de/ids_mannheim/korap/web/filter/BlockingFilter.java
index 7c1a625..bb14e10 100644
--- a/core/src/main/java/de/ids_mannheim/korap/web/filter/BlockingFilter.java
+++ b/core/src/main/java/de/ids_mannheim/korap/web/filter/BlockingFilter.java
@@ -7,6 +7,7 @@
 import javax.ws.rs.Priorities;
 import javax.ws.rs.container.ContainerRequestContext;
 import javax.ws.rs.container.ContainerRequestFilter;
+import javax.ws.rs.core.SecurityContext;
 
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
@@ -31,12 +32,13 @@
     public void filter (ContainerRequestContext request) {
         TokenContext context;
 
-        try {
-            context = (TokenContext) request.getUserPrincipal();
+        SecurityContext securityContext = request.getSecurityContext();
+        if (securityContext != null) {
+            context = (TokenContext) securityContext.getUserPrincipal();
         }
-        catch (UnsupportedOperationException e) {
+        else {
             throw kustvaktResponseHandler.throwit(new KustvaktException(
-                    StatusCodes.UNSUPPORTED_OPERATION, e.getMessage(), e));
+                    StatusCodes.UNSUPPORTED_OPERATION));
         }
 
         if (context == null || context.isDemo()) {
diff --git a/core/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java b/core/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java
index d28bd39..97aa875 100644
--- a/core/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java
+++ b/core/src/main/java/de/ids_mannheim/korap/web/filter/DemoFilter.java
@@ -26,10 +26,7 @@
         String authentication =
                 request.getHeaderValue(ContainerRequest.AUTHORIZATION);
         if (authentication == null || authentication.isEmpty()) {
-            try {
-                request.getUserPrincipal();
-            }
-            catch (UnsupportedOperationException e) {
+            if (request.getSecurityContext() == null) {
                 request.setSecurityContext(createContext());
             }
         }
diff --git a/core/src/main/java/de/ids_mannheim/korap/web/filter/DemoUserFilter.java b/core/src/main/java/de/ids_mannheim/korap/web/filter/DemoUserFilter.java
index 8a88a2d..b34d4b7 100644
--- a/core/src/main/java/de/ids_mannheim/korap/web/filter/DemoUserFilter.java
+++ b/core/src/main/java/de/ids_mannheim/korap/web/filter/DemoUserFilter.java
@@ -7,6 +7,7 @@
 import javax.ws.rs.container.ContainerRequestContext;
 import javax.ws.rs.container.ContainerRequestFilter;
 import javax.ws.rs.core.Context;
+import javax.ws.rs.core.SecurityContext;
 import javax.ws.rs.core.UriInfo;
 
 import org.springframework.beans.factory.annotation.Autowired;
@@ -44,11 +45,9 @@
         // means that this is the public service
         if (authentication == null || authentication.isEmpty()) {
             Principal pr = null;
-            try {
-                pr = request.getUserPrincipal();
-            }
-            catch (UnsupportedOperationException e) {
-                // do nothing
+            SecurityContext securityContext = request.getSecurityContext();
+            if (securityContext != null) {
+                pr = securityContext.getUserPrincipal();
             }
             if (pr == null)
                 request.setSecurityContext(new KustvaktContext(
diff --git a/core/src/main/java/de/ids_mannheim/korap/web/filter/NonDemoBlockingFilter.java b/core/src/main/java/de/ids_mannheim/korap/web/filter/NonDemoBlockingFilter.java
index feadf45..c4b539a 100644
--- a/core/src/main/java/de/ids_mannheim/korap/web/filter/NonDemoBlockingFilter.java
+++ b/core/src/main/java/de/ids_mannheim/korap/web/filter/NonDemoBlockingFilter.java
@@ -7,6 +7,7 @@
 import javax.ws.rs.Priorities;
 import javax.ws.rs.container.ContainerRequestContext;
 import javax.ws.rs.container.ContainerRequestFilter;
+import javax.ws.rs.core.SecurityContext;
 
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
@@ -33,12 +34,13 @@
     @Override
     public void filter (ContainerRequestContext request) {
         TokenContext context;
-        try {
-            context = (TokenContext) request.getUserPrincipal();
+        SecurityContext securityContext = request.getSecurityContext();
+        if (securityContext != null) {
+            context = (TokenContext) securityContext.getUserPrincipal();
         }
-        catch (UnsupportedOperationException e) {
+        else {
             throw kustvaktResponseHandler.throwit(new KustvaktException(
-                    StatusCodes.UNSUPPORTED_OPERATION, e.getMessage(), e));
+                    StatusCodes.UNSUPPORTED_OPERATION));
         }
 
         if (context == null || context.isDemo()) {
diff --git a/core/src/main/java/de/ids_mannheim/korap/web/filter/PiwikFilter.java b/core/src/main/java/de/ids_mannheim/korap/web/filter/PiwikFilter.java
index 93d97ff..5224bd6 100644
--- a/core/src/main/java/de/ids_mannheim/korap/web/filter/PiwikFilter.java
+++ b/core/src/main/java/de/ids_mannheim/korap/web/filter/PiwikFilter.java
@@ -8,6 +8,7 @@
 import java.util.Map;
 import java.util.Random;
 
+import javax.ws.rs.core.SecurityContext;
 import javax.ws.rs.core.UriBuilder;
 
 import org.apache.logging.log4j.LogManager;
@@ -120,18 +121,22 @@
     public void filter (ContainerRequestContext request) {
         if (ENABLED) {
             try {
-                TokenContext context = (TokenContext) request
-                        .getUserPrincipal();
-                if (context.getUsername() != null){
-                    // since this is cached, not very expensive!
-                    User user = authenticationManager.getUser(context.getUsername());
-                    Userdata data = authenticationManager
-                            .getUserData(user, UserSettingProcessor.class);
-                    if ((Boolean) data.get(Attributes.COLLECT_AUDITING_DATA))
-                        customVars.put("username", context.getUsername());
+                TokenContext context;
+                SecurityContext securityContext = request.getSecurityContext();
+                if (securityContext != null) {
+                    context = (TokenContext) securityContext.getUserPrincipal();
+
+                    if (context.getUsername() != null){
+                        // since this is cached, not very expensive!
+                        User user = authenticationManager.getUser(context.getUsername());
+                        Userdata data = authenticationManager
+                                .getUserData(user, UserSettingProcessor.class);
+                        if ((Boolean) data.get(Attributes.COLLECT_AUDITING_DATA))
+                            customVars.put("username", context.getUsername());
+                    }
                 }
             }
-            catch (KustvaktException | UnsupportedOperationException e) {
+            catch (KustvaktException e) {
                 //do nothing
             }
             send(request);