NPE in oauth2 module for jose auth code tokens

org.apache.cxf.rs.security.oauth2.provider.JoseSessionTokenProvider#protectStateString calls org.apache.cxf.rs.security.oauth2.provider.JoseSessionTokenProvider#getInitializedEncryptionProvider which calls org.apache.cxf.rs.security.jose.jwe.JweUtils#loadEncryptionProvider(org.apache.cxf.rs.security.jose.jwe.JweHeaders, boolean) with headers == null but in the stack org.apache.cxf.rs.security.jose.jwe.JweUtils#loadKeyEncryptionProvider assumes headers != null which leads to a NPE