I'm going through an upgrade from 6.3 to the latest 6.5.  In the code there are lines to get a reference to the XssApi:

import org.apache.sling.xss.XSSAPI;

this.xssAPI = this.resource.getResourceResolver().adaptTo(XSSAPI.class);

The problem is... xssAPI is "null".  I've tried referencing it as well with no luck:

@Reference

private XSSAPI xssAPI;

Has anyone else come across this issue?