Fixes COMETD-443 (SecurityPolicy.canCreate() may be called with a
null session).

Also updated SecurityPolicy's javadocs.