Use StringBuilder instead of StringBuffer in private code

There's other places where IMHO using a StringBuilder would make sense, but that's public/protected APIs.