The `Set` implementation returned by the `getPrincipals()`, `getPublicCredentials()`, and `getPrivateCredentials()` methods of a `Subject` object now deals with null values differently. Instead of throwing a `NullPointerException`, when calling `contains()` or `remove()` on null, false is returned, when calling `containsAll()` on a collection containing null, false is returned, when calling `removeAll()` or `retainAll()` on a collection containing a null value, the null value is ignored.