Advanced form based authentication

We use form based authentication with a full-fledged JSF ajaxified page. Notably it relies on HttpServletRequest#login instead of j_security_check. This allows to us to easily implement the login page with same look-and-feel as the other pages of our application: error handling, notifications, visual styling; and no "j_security_check in browser address bar after failed login" problem.
We only wish this was supported better at the spec level. For example, the original request preservation feature creates problems: it can't possibly work here because of JSF's javax.faces.ViewState parameter - if it comes from a dead view in a dead session, then it just won't work. We had to work around it by cleaning the container stored request.
#### Affected Versions
[4.0]