BaseLoginFilter.SecurityHttpRequestWrapper overrides getRemoteUser but doesn't set the user it gets from the authenticator on the wrapped request.

We see this problem in Confluence on the 500page.jsp. It tries to report the username for the errored request but always reports anonymous since by the time the filter stack has unwound and the 500page is being compiled we are dealing with an unwrapped request.

It would be nice if the implementation of BaseLoginFilter.SecurityHttpRequestWrapper#getRemoteUser() would actually set the user String it finds on the wrapped request.