Hello,
I've noticed that the sendRedirects roller is sending (eq. login-redirect.jsp and others) is not properly encoded to support URL rewriting (not using cookies for session). Eq. response.sendRedirect("somePathHere"); it's supposed to be response.sendRedirect(response.encodeRedirectURL("somePathHere")); so that the ;jsessionid's gets added when cookies are disabled (instead of losing the session al together).