From: Shing Wai Chan <shing.wai.chan_at_oracle.com>
Date: Fri, 08 Feb 2013 17:02:20 -0800

I am looking at discussion in http://java.net/jira/browse/SERVLET_SPEC-14
("Require FORM auth to issue 303 redirects")

Let me highlight some of the discussion.
* Always use 303 redirects
* Always pass GET requests through the FORM authenticator (independent
of whether the resource is protected for GET
* restore to the original verb

Note that 303 is not in HTTP/1.0.

Any comments?
Shing Wai Chan