nwing:

I've just reviewed all these changes, and they look good, except that the issue resolved by my second patch file is still an issue in your version.
To fix it, remove the session invalidation in CASClientCallback.handleUnauthorizedUser(). If we invalidate the session at that point, and the unauthorized URL is an element on the page, like an image, it will disrupt our Vaadin communications and they get the dreaded "Communication Error".