View and endpoint security should work when `http.sessionManagement().sessionFixation().migrateSession()` is used See also https://github.com/vaadin/flow/issues/11031