Sorry, I missed your post where you'd isolated the problem to spring security. I get the feeling that spring security is somehow introducing the exact same bug as GAE.
Can you try adding the filter from the GAE fix to your module? I have a hunch that it will fix this your issue too. http://tinyurl.com/nxka465 https://bitbucket.org/akochnev/tap5-gae-utils/wiki/Home
