Merge remote-tracking branch 'origin/jetty-9.4.x'

jetty-security/src/main/java/org/eclipse/jetty/security/authentication/FormAuthenticator.java

@@ -258,7 +258,21 @@ public class FormAuthenticator extends LoginAuthenticator
         if (isLoginOrErrorPage(URIUtil.addPaths(request.getServletPath(),request.getPathInfo())) &&!DeferredAuthentication.isDeferred(response))
             return new DeferredAuthentication(this);
 
-        HttpSession session = request.getSession(true);
+        HttpSession session = null;
+        try
+        {
+            session = request.getSession(true);
+        }
+        catch (Exception e)
+        {
+            if (LOG.isDebugEnabled())
+                LOG.debug(e);
+        }
+        
+        //if unable to create a session, user must be
+        //unauthenticated
+        if (session == null)
+            return Authentication.UNAUTHENTICATED;
 
         try
         {

pom.xml

@@ -20,7 +20,7 @@
     <slf4j-version>1.6.6</slf4j-version>
     <jetty-test-policy-version>1.2</jetty-test-policy-version>
     <alpn.api.version>1.1.3.v20160715</alpn.api.version>
-    <jsp.version>8.5.5</jsp.version>
+    <jsp.version>8.5.9</jsp.version>
     <!-- default values are unsupported, but required to be defined for reactor sanity reasons -->
     <alpn.version>undefined</alpn.version>
   </properties>