As can be seen from the attached screenshot, CachedPathMapper.cacheAllMap caches the security rules that apply for each individual URL that is queried and the value is nearly always (at least in JIRA's case) an empty collection with the default size of 10. Further, the cache is not bounded by either space or time.

There must be a better way.