Change AbstractAuthenticationToken.getAuthorities to be mutable

[sincang]

In the class AbstractAuthenticationToken, Array of GrantedAuthority is aways wrapped with Collections.unmofiableList. Will it be possible to make this list just modifiable? The reason is this stops OauthTokenEnhancer to modify the authorities. The use case is based on the Client scope, token enhancer should be able to remove unrelevant roles or authorities.

[rwinch]

We cannot make it mutable as this causes concurrency problems. The approach you need to take is to create a new instance of the Authentication with updated authorities