Fix implies method for CodeSources with a null location

The location of a codesource is now checked for null and furthermore codesources with a null
location and a null certificate chain are now granted to do everything.
Set session ID strength to be at least 100 bit (25 half-bytes)