SEC-2578: HttpSessionSecurityContextRepository traverses HttpServletResponseWrapper