I proposed a solution for
WICKET-3514, which I had been using myself. I didn't notice that it was incorporated into Wicket. This patch represents a bug fix I made to the new CryptoMapper which is not in Wicket.
Encrypted URLs for the home page (where the unencrypted URL is something like "?4" - no segments, just parameters) are not correctly decrypted.