A separate instance of this class is created every time renderRequest.getAttribute(PortletRequest.USER_INFO) is called. It is safe to cache attributes in this instance because you can assume that all calls to this instance belong to the same user.
renderRequest.getAttribute(PortletRequest.USER_INFO)