Ok - I have now identified the issue.
I created my own custom ServerAuthModule for FORM login. I got it running to find the same problem. The issue was that the HttpServletRequest passed into the SAM has a null characterset. Thus the incoming bytes were assumed to be latin1. The funny characters you see will be one unicode character for each byte of input data (as latin1 is a single byte charset).
I set the encoding to "UTF-8" on the HttpServletRequest in my custom SAM before reading any data and things look ok.
The only problem now is to discover if it is possible to feed a parameters/setting to the default web-app security handler to get it to set the character set. If not i will have to use my home-rolled SAM. I wonder if it is just a well hidden setting or a bug.
[Message sent by forum member 'andrewmp']
http://forums.java.net/jive/thread.jspa?messageID=484129