title: NullPointerException with Owasp.CsrfGuard.Test
body: <p>Why do I get:   </p>
  
  <pre><code>java.lang.NullPointerException org.owasp.csrfguard.CsrfGuardFilter.doFilter(CsrfGuardFilter.java:53)
  </code></pre>
  
  <p>when trying to run the <a href="https://github.com/esheri3/OWASP-CSRFGuard/tree/master/Owasp.CsrfGuard.Test" rel="nofollow">0wasp.CsrfGuard.Test</a> example app on Tomcat 5.5?</p>
  
  <p>I'm using the example app exactly as it came in the download but with the following changes to get around <code>listener</code> errors:</p>
  
  <ul>
  <li><p>I downloaded the CsrfGuard 3.0.0 package and copied the <code>Owasp.CsrfGuard.jar</code> to <code>WEB-INF/lib</code> to get around the listeners not being found.  </p></li>
  <li><p>I changed the web.xml file to use the listener that comes with the <code>Owasp.CsrfGuard.jar</code> rather than the two listeners in the original <code>web.xml</code>, which don't exist.  </p></li>
  </ul>
  
  <p>When I start the app there are no errors but when I point my browser to the <code>/Owasp.CsrfGuard.Test/index.html</code> page, I get the above error.  </p>
  
  <p>Any ideas to try?  </p>
  
  <p>Update...</p>
  
  <p>Several hours later and I got it working without error.  I don't understand why but the filter errors seem to stick around even after stopping and restarting a webapp (in Tomcat at least).  I had to rename that webapp's directory, wait 10 seconds for Tomcat to auto-undeploy it, rename it back to its original directory name, and wait 10 seconds for Tomcat to recognize it as a new webapp.  I also removed the "x-requested-with" init-param from the web.xml file since I don't use AJAX.  Don't know if that really needed to come out but it works so I'm leaving it out.</p>
  
  <p>Now, the "protect.html" file is indeed protected but it is protected too well.  I can't get to it at all.  If I try to go directly to the protect.html page, it should not allow that, which it doesn't.  However, it should allow me to get there through the proper webpage flow with all the pages getting the proper token(s).</p>
  
  <p>The question now is how can I get to the protect.html page?</p>
  
  <p>Thanks.</p>