The CachedAuthenticatedSessionHandler never uses the returned value - but regardless - I agree - we should keep the return value consistent with the behavior of undertow's default session manager.  I'll send a revision in a bit.