Bug in TokenStoreCallbackHandler

There's a bug in WSS4JInInterceptor.TokenStoreCallbackHandler which manifests itself in Secure Conversation under certain circumstances.

When CXF issues a SecurityContextToken it includes a wst:RequestedAttachedReference, however other stacks only return a SecurityContextToken. When trying to retrieve the SecurityContextToken in SecurityTokenReference in WSS4J it calls the TokenStoreCallbackHandler, which sets:

pc.setCustomToken(tok.getAttachedReference());

If there is no attached reference as in this scenario, the custom token is set to null and ends up causing an error in WSS4J. The correct fix is to call:

pc.setCustomToken(tok.getToken());