26478 has revealed that tests exercising code that need SessionCookieConfig aren't mocking it properly when setuping the ServletContext.