The SecurityContextFactory defaults to using the TCCL for loading classes.

The order should be:

1) Passed in ClassLoader
2) ClassLoader that defined SecurityContextFactory
3) TCCL