CSRF token generation fails on Glassfish

Because Glassfish bundles its own commons-codec library which is based on commons-codec-1.3, and which shadows our own commons-codec-1.4 jar, which we need since it provides critical methods not available in 1.3.