Major Description
According to http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-os.html the wsu:Created and wsu:Expires are optional elements in /wst:RequestSecurityToken/wst:Lifetime.
When creating the org.apache.cxf.ws.security.tokenstore.SecurityToken using a lifetime Element where not both (created and expired) elements are set, a NullPointerException is thrown as there is no null-check on the child elements of the lifetime element.