Occasional 500 errors from stash - NPE in XSRF token validation

Occasionally we get 500 errors back from stash.

I'm not 100% sure what the trigger is, but it may be related to users waiting a long time (20 minutes) between a form loading and them submitting it.

The backtrace (attached) seems the same in all cases.

The error just says "Please contact your system administrator".

In this case, it was the project creation form that was being submitted, http://our-server-name:7990/projects?create

Clicking back, then reload, then re-filling the form with the exact same data, then submitting again, seems to work.

I'm not sure if this can be replicated.