CVE-2017-2589: Insecure cookie sharing in Hawtio

The vulnerability stems from using a singleton HttpClient with a persistent cookie store. The advisory explicitly states this pattern causes cookie sharing between clients. The function responsible for HttpClient initialization would be where the cookie store is configured. While exact code isn't shown, Hawtio's architecture patterns and Java servlet conventions make ProxyServlet.createHttpClient the most likely candidate, as it would control proxy client configuration. The fix in 1.5.0 likely replaced this with per-request/client cookie stores.