fix 8757, get rid of service locator antipattern

This gets rid of the last service locator occurrence which also broke phpunit tests, see #8757 

Since I've changed the SecurityMiddleware, please review properly

@DeepDiver1975 @MorrisJobke 

@LukasReschke please review