Asking for a friend, of course. I know it's forbidden by specification to not check and it will void his warranty, but is it intended that the OptionalMessageReplaySecurityHandler and OptionalMessageLifetimeSecurityHandler beans declared in system\flows\saml\security-beans.xml be usable in production?