Java EE (Java Enterprise Edition) General Discussion

Hi.
I have an ancient doubt about JAAS autentication on Web applications. By using form autentication, when navigating in a page that has some kind of role restriction, the request.getUserPrincipal() returns the correct Principal value.
But, if I navigate to a unrestricted area, the getUserPrincipal returns null. And the odd thing is, I can navigate back to the restricted area becouse without need of new login. Why?
So, my question is, How can I get the current Principal in a servlet, and how can I check if a user is in Role by just using plain JAAS/J2ee.
I use Tomcat and Tomcat+Jboss, and both give the same situation.
I'm not importing any tomcat/jboss jar.
Thanks