Shiro Authentication Changes

After much poking around I think I have got it.

In short as we use Spring all the Shiro config needs to be in the XML files. Ours is in security.xml.

I have:
* Set the session timeout to 4 hours
* Enabled Shiro sessions
* Put in ehcache.xml and XML config with shiro
* Put lots of debug messages in the UmsRealm.java
* Added more shiro annotation / spring config we seem to miss

Based on many blog posts, code debugs, shiro doc and git hub repos.

This seems to be the closest to our issue:
http://shiro-user.582556.n2.nabble.com/Cached-Session-DAO-timing-out-and-expiring-session-td7579309.html