X-Shindig-St behaves differently when the security token is null between Firefox and WebKit browsers

From Doug Davies:

Here's what I think it going on.

In io.js this code

var opt_headers =

{ 'X-Shindig-ST' : shindig.auth.getSecurityToken() }

;

behaves differently. Even though I see both browsers set it as follows:

{"X-Shindig-ST":null}

later on in UrlParameterAuthenticationHandler it's set to the STRING "null"
(not the value null) for webkit browsers.

// no token yet, see if it was attached as a header
if (StringUtils.isEmpty(token)) {
String t = request.getHeader( "X-Shindig-ST" );
if (StringUtils.isNotBlank(t))

{ token = t; }

}

This blows up during decryption: