A minor typo in the Javadoc which makes it extremely hard to test the features of CompositeCallback:

http://dev.magnolia-cms.com/ref/4.3.2/apidocs/info/magnolia/cms/security/auth/callback/CompositeCallback.html

url ./magnolia*

should read

url /.magnolia*

When used as documented, all one gets is a blank screen when trying to log in.

(Things are fine as long one does not log out of the authoring instance, and uses another browser for testing. But if logged out, then to get back into the authoring instance, simply specify the credentials in URL query parameters. Like: .magnolia/pages/adminCentral.html?mgnlUserId=superuser&mgnlUserPSWD=superuser)