I suspect I just fixed your bug, the CSRF manager bean wasn't getting initialized and it became a lifecycle-managed component with that identifier commit. The wisdom of all that init/destroy stuff is starting to become less and less clear (I think it's entirely clear it was a terrible idea) but we're too far in to back it out right now. -- Scott