Passing the NullSerializer downstream to the Message{Encryptor,Verifier} allows us to handle the (de)serialization step within the cookie jar, which gives us the opportunity to detect and migrate legacy cookies.