indeed it's part of the specific features of the Portlet API that are not yet bridged in Juzu.
I quickly implemented the feature in a programmatic manner on URLBuilder and in a declarative manner with @Application(escapeXML = true) . I think the second form is more appropriate as it will always pre configure URLBuilder to generate XML escaped URLs and does not require to add specific code for managing that in the application.
I will look at the other API parts you want to be bridged (like isUserInRole) soon.
Merry Christmas
Julien