setRememberToken without password returns an empty string instead of the token #928

DefaultHTTPUtilities.setRememberToken(HttpServletRequest, HttpServletResponse, int, String, String) always returns an empty string when it succeeds.

The method builds the sealed token and adds the cookie. But it returns rval, which is set to "" at the top and never updated. The deprecated overload that takes a password returns cryptToken as expected. So callers of the newer method can't get the token they just set.

I mentioned this in #926 while fixing the HTTPUtilities Javadoc. Happy to send a small fix with a test.