SEC-2303: WebSecurity sets the Bean resolver
SEC-2352: HttpSessionCsrfTokenRepository lazy session creation
SEC-2306: Fix Session Fixation logging race condition

Previously session fixation protection could output an incorrect warning
that session fixation protection did not work.

The code now synchronizes on WebUtils.getSessionMutex(..).