Advanced session hijacking mitigation

utilizing ssl_session_id (when mod_ssl is enabled) and ip/user-agent
when using raw http connections an additional check is done to ensure
that cooked are not copied between systems thus preventing session
hijacking

If a user with a valid CAS session attempts to copy another user's
cookie the existing CAS session will simply reestablish and the stolen
cookie will be invalidated.
While this could potentially create a denial of service; the risk is
limited to non-https connections.

In addition the isSSL function now utilizes the mod_ssl optional function ssl_is_https 
So, I'm guessing this assumes that subsequent TLS negotiations will use TLS session resumption, which probably holds for most clients -- have you tested with mobile clients or firewalls / proxies / load balancers fronting a mod_auth_cas install that may behave differently?

Do you offhand have any reference information on how long a client will cache a TLS session, and how that compares with the default values for the CAS session timeouts?