SEC-2491: KeyBasedPersistenceTokenService defaults to 32 bytes
SEC-2749: CsrfConfigurer.requireCsrfProtectionMatcher correct null check