It's safe to ignore the exception in this case. Changed log level to 'Debug'.

Now the exception in the log is gone but the issue remains

I call identity.logout and my security restrictions moves me to the login page but I see my username pre-populated with the
identity.username and then I get the "User Session Expired". A refresh fixes the issue and one can move on but the
functionality is different from DR#3.

Delay that comment. The exception is still there but looking at the repository dates one can think that it's not yet committed, correct?

Now I think I got the fix. The issue is half fixed, the identity.username is no longer pre-populated but the "User Session Expired" popup still appears.

Yes, this issue is not fixed yet. ICE-1909 fixes just uncovered problems that we didn't realize we had.

Delaying session invalidation proved to be a bad choice since JBoss+Catalina reuses session objects and IDs which causes a lot of confusion in applications that have logout processes (invalidate session and immediately initiate new session).
Instead session is invalidated right after the session bound servers are shut down.
The change described above broke the fixes for ICE-1909, because session now is invalidated in the middle of the JSF lifecycle. So, the solution was to detect immediately that the JSF lifecycle was interrupted and respond with a 'session-expired' message right away.