As identified in https://github.com/spring-projects/spring-security/pull/18872/changes#r2913712989, CacheSaml2AuthenticationRequestRepository doesn't have a reasonable mechanism by which it can remove a cached value when the value passed in is null