Reverted changes concerning security to webapp-passivating in web and CommonHttpSessionServlet now creates new SerialBean if it was null before (not only if the session is new) - this makes it compliant with FORM authentication.