WICKET-6730: remove the need for synchronized

The ISecureRandomSupplier is used from request threads and can
be needed several times per request. Synchronization will make
this an application wide bottleneck, which is a bad thing.
diff --git a/wicket-core/src/main/java/org/apache/wicket/settings/SecuritySettings.java b/wicket-core/src/main/java/org/apache/wicket/settings/SecuritySettings.java
index 6e225a4..9556f98 100644
--- a/wicket-core/src/main/java/org/apache/wicket/settings/SecuritySettings.java
+++ b/wicket-core/src/main/java/org/apache/wicket/settings/SecuritySettings.java
@@ -59,7 +59,7 @@
 	private ICryptFactory cryptFactory;
 	
 	/** supplier of random data and SecureRandom */
-	private ISecureRandomSupplier randomSupplier;
+	private ISecureRandomSupplier randomSupplier = new DefaultSecureRandomSupplier();
 
 	/**
 	 * Whether mounts should be enforced. If {@code true}, requests for a page will be
@@ -120,17 +120,13 @@
 	}
 
 	/**
-	 * Returns the {@link ISecureRandomSupplier} to use for secure random data. If no supplier is
-	 * set, a {@link DefaultSecureRandomSupplier} is instantiated.
+	 * Returns the {@link ISecureRandomSupplier} to use for secure random data. If no custom
+	 * supplier is set, a {@link DefaultSecureRandomSupplier} is used.
 	 * 
 	 * @return The {@link ISecureRandomSupplier} to use for secure random data.
 	 */
-	public synchronized ISecureRandomSupplier getRandomSupplier()
+	public ISecureRandomSupplier getRandomSupplier()
 	{
-		if (randomSupplier == null)
-		{
-			randomSupplier = new DefaultSecureRandomSupplier();
-		}
 		return randomSupplier;
 	}
 
@@ -193,7 +189,7 @@
 	 *            The new supplier, must not be null.
 	 * @return {@code this} object for chaining
 	 */
-	public synchronized SecuritySettings setRandomSupplier(ISecureRandomSupplier randomSupplier)
+	public SecuritySettings setRandomSupplier(ISecureRandomSupplier randomSupplier)
 	{
 		Args.notNull(randomSupplier, "randomSupplier");
 		this.randomSupplier = randomSupplier;