The method CryptoTokenManagementSessionBean.assertAuthorization takes a cryptoTokenId parameter (which is not used at all) and a resource parameter (which also includes the cryptoTokenId)

This method and calls to it should be refactored. Either by removing the cryptoTokenId parameter, or by passing a partial resource parameter without the cryptoTokenId appended to it.