javax.security.auth.Subject.doAsPrivileged (both overloaded methods) creates an
empty array of ProtectionDomains each time it is invoked if the AccessControlContext
parameter is null. 

This is unnecessary overhead, since this array is immutable and never changed. Instead
the array should be a static and instantiated once and reused, ex:

    private static final ProtectionDomain[] EMPTY_PROTECTION_DOMAIN_SET =
        new ProtectionDomain[0];

...

        final AccessControlContext callerAcc =
                (acc == null ?
                new AccessControlContext(EMPTY_PROTECTION_DOMAIN_SET) :
//              new AccessControlContext(new ProtectionDomain[0]) :
                acc);


This shows up as a small issue when analyzing memory utilization of the App Server with
a Security Manager enabled.