Merge branch 'v4.2'

2 files changed, 12 insertions, 7 deletions

diff --git a/src/DotNetOpenAuth.Core/Messaging/MessagingUtilities.cs b/src/DotNetOpenAuth.Core/Messaging/MessagingUtilities.cs
index 388157a..e859162 100644
--- a/src/DotNetOpenAuth.Core/Messaging/MessagingUtilities.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/MessagingUtilities.cs
@@ -2026,17 +2026,22 @@ namespace DotNetOpenAuth.Messaging {
 			/// <summary>
 			/// A thread-local instance of <see cref="Random"/>
 			/// </summary>
-			private static readonly ThreadLocal<Random> threadRandom = new ThreadLocal<Random>(delegate {
-				lock (threadRandomInitializer) {
-					return new Random(threadRandomInitializer.Next());
-				}
-			});
+			[ThreadStatic]
+			private static Random threadRandom;
 
 			/// <summary>
 			/// Gets a random number generator for use on the current thread only.
 			/// </summary>
 			public static Random RandomNumberGenerator {
-				get { return threadRandom.Value; }
+				get {
+					if (threadRandom == null) {
+						lock (threadRandomInitializer) {
+							threadRandom = new Random(threadRandomInitializer.Next());
+						}
+					}
+
+					return threadRandom;
+				}
 			}
 		}
 
diff --git a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/WebServerClient.cs b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/WebServerClient.cs
index 1fdd372..879e4e3 100644
--- a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/WebServerClient.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/WebServerClient.cs
@@ -117,7 +117,7 @@ namespace DotNetOpenAuth.OAuth2 {
 				cookie = new HttpCookie(XsrfCookieName, xsrfKey) {
 					HttpOnly = true,
 					Secure = FormsAuthentication.RequireSSL,
-					Expires = DateTime.Now.Add(OAuth2ClientSection.Configuration.MaxAuthorizationTime),
+					////Expires = DateTime.Now.Add(OAuth2ClientSection.Configuration.MaxAuthorizationTime), // we prefer session cookies to persistent ones
 				};
 				request.ClientState = xsrfKey;
 			}