erzykrlk's solution is better, just disable useSession in Cas2ValidationFilter