CSRF prevention does not work with https URLs on the default port

If your URL is https on the default port (so no :443 on the end), then the CSRF prevention (WICKET-5919) rejects requests with the Origin header supplied.

In CsrfPreventionRequestCycleListener, line 519 looks like this

if (port != -1 && "http".equals(scheme) && port != 80 || "https".equals(scheme) && port != 443)

So the port != -1 test binds only to the "http" half of the or statement, and the if block executes, which appends ":-1" to the end of the "https" URL. I think it should instead say

if (port != -1 && ("http".equals(scheme) && port != 80 || "https".equals(scheme) && port != 443))