Provider should cache instances of stateless factories it creates

Our security provider(s) return instances of various factories, these are largely stateless so the instances created should be cached so they can be returned again for future calls.