I would try to move around the code in this class:
* Some of the code is config specific and belongs in the config jar
* By embedding the session fixation protection logic in a enum we prevent others from providing implementations. We should have this logic in an interface