Major Description
Currently the following JCR code snippet causes a duplicate NodeState-level property lookup:
node.getProperty("name").getString();
The reason for this is that the getProperty() call needs to first check for whether the property exists (otherwise it should throw an exception), which results in a SecureNodeBuilder.hasProperty() call, which in turn needs to call getProperty() as the permission checks use the full PropertyState instead of just the property name. But then the retrieved property state is discarded.
Then during the getString() call the previously returned PropertyDelegate will re-retrieve the underlying PropertyState.
A better alternative would be to either make the permission checks use just the property name or to make the PropertyDelegate keep track of the already retrieved PropertyState.