NullPointerException in CAS 5.3.16

I've upgraded from CAS 5.3.15.1 to 5.3.16 because of a security alert, but now some of my tests fail upon login and the logfile shows a NullPointerException. Has anyone successfully upgraded to 5.3.16?

cas-server | Caused by: javax.servlet.ServletException: RegisteredServiceResponseHeadersEnforcementFilter is blocking this request. Examine the cause in this stack trace to understand why.
cas-server |    ... 97 more
cas-server | Caused by: java.lang.NullPointerException
cas-server |    at org.apereo.cas.services.web.support.RegisteredServiceResponseHeadersEnforcementFilter.shouldHttpHeaderBeInjectedIntoResponse(RegisteredServiceResponseHeadersEnforcementFilter.java:115)
cas-server |    at org.apereo.cas.services.web.support.RegisteredServiceResponseHeadersEnforcementFilter.decideInsertCacheControlHeader(RegisteredServiceResponseHeadersEnforcementFilter.java:79)
cas-server |    at org.apereo.cas.security.ResponseHeadersEnforcementFilter.doFilter(ResponseHeadersEnforcementFilter.java:228)
cas-server |    ... 96 more