Like it is done for customfields and orderableFields
Then i could do something like this (e.g. timespent-columnview.vm)

#if ($authcontext.user.inGroup('group'))
$textutils.htmlEncode($timespent)
#end

I guess this is missing in getVelocityParams(...) or is there a reason?

velocityParams.put("authcontext", authenticationContext);