With MAGNOLIA-5625 we try to retrieve the current User from MgnlContext earlier as we did before. Unfortunately SecuritySupport has not been instantiated at that time so it is null by then. We could cope with that situation (e.g. return null as User and not set createdBy) if later - once the SecuritySupport has been instantiated - we'd get the proper instance from our component provider. But as SecuritySupport is a Singleton we'll always get null now.

Best would be to define a default implementation for SecuritySupport that's just to be used in the initialization phase and will then be replaced by the configured one, once the later is available. We anyway know that for the initialization phase there's only one super -> the superuser.