Servlet calling HttpServletRequest.isUserInRole(null) causes NPE using Jetty container

The servlet isUserInRole call eventually gets delegated to
org.apache.geronimo.jetty.JAASJettyRealm.isUserInRole, which causes a NPE in
javax.security.jacc.WebRoleRefPermission.hashCode().

JAASJettyRealm.isUserInRole creates a WebRoleRefPermission, passing it the
null role that it was passed, then delegates the role check to
java.security.AccessControlContext.checkPermission, passing it the WebRoleRefPermission.
When the web role ref permission gets checked, eventually its hashcode method is called,
which tries to compute the hash by getting the hashcode of the (null) role name,
which throws the NPE.