KI-72: swapped out commons-logging for slf4j

git-svn-id: https://svn.apache.org/repos/asf/incubator/jsecurity/trunk@759309 13f79535-47bb-0310-9956-ffa450edef68
diff --git a/README-runtime-requirements.txt b/README-runtime-requirements.txt
index 8bad1ea..dc8169d 100644
--- a/README-runtime-requirements.txt
+++ b/README-runtime-requirements.txt
@@ -9,8 +9,9 @@
 
 Minimal required dependencies
 -------------
-Java 1.5 and later: Ensure ki.jar and Apache commons-logging.jar are in your application's classpath.
-Java 1.3 and 1.4 only: ki.jar, commons-logging.jar and retroweaver.jar and its associated dependendencies
+Java 1.5 and later: Ensure ki-all.jar, slf4j-api.jar and one of slf4j's
+                    bindings (slf4j-simple.jar, slf4j-log4j12, etc) are in your application's classpath.
+Java 1.3 and 1.4 only: ki.jar, slf4j-api.jar, an slf4j bindng, retroweaver.jar and its associated dependendencies
 
 
 Feature-based dependencies
diff --git a/core/pom.xml b/core/pom.xml
index a269860..4fac667 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -33,13 +33,19 @@
 
     <dependencies>
         <dependency>
-            <groupId>commons-logging</groupId>
-            <artifactId>commons-logging</artifactId>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-api</artifactId>
         </dependency>
         <dependency>
             <groupId>commons-beanutils</groupId>
             <artifactId>commons-beanutils</artifactId>
         </dependency>
+
+        <!-- Test dependencies -->
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-simple</artifactId>
+        </dependency>
     </dependencies>
 
 </project>
diff --git a/core/src/main/java/org/apache/ki/authc/AbstractAuthenticator.java b/core/src/main/java/org/apache/ki/authc/AbstractAuthenticator.java
index b4591d1..099e869 100644
--- a/core/src/main/java/org/apache/ki/authc/AbstractAuthenticator.java
+++ b/core/src/main/java/org/apache/ki/authc/AbstractAuthenticator.java
@@ -21,8 +21,8 @@
 import java.util.ArrayList;
 import java.util.Collection;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.subject.PrincipalCollection;
 
@@ -49,7 +49,7 @@
     |             C O N S T A N T S             |
     ============================================*/
     /** Private class log instance. */
-    private static final Log log = LogFactory.getLog(AbstractAuthenticator.class);
+    private static final Logger log = LoggerFactory.getLogger(AbstractAuthenticator.class);
 
     /*--------------------------------------------
     |    I N S T A N C E   V A R I A B L E S    |
diff --git a/core/src/main/java/org/apache/ki/authc/credential/SimpleCredentialsMatcher.java b/core/src/main/java/org/apache/ki/authc/credential/SimpleCredentialsMatcher.java
index edfb44a..bcc63f2 100644
--- a/core/src/main/java/org/apache/ki/authc/credential/SimpleCredentialsMatcher.java
+++ b/core/src/main/java/org/apache/ki/authc/credential/SimpleCredentialsMatcher.java
@@ -20,8 +20,8 @@
 
 import java.util.Arrays;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authc.AuthenticationInfo;
 import org.apache.ki.authc.AuthenticationToken;
@@ -44,7 +44,7 @@
  */
 public class SimpleCredentialsMatcher extends CodecSupport implements CredentialsMatcher {
 
-    private static final Log log = LogFactory.getLog(SimpleCredentialsMatcher.class);
+    private static final Logger log = LoggerFactory.getLogger(SimpleCredentialsMatcher.class);
 
     /**
      * Returns the <tt>token</tt>'s credentials.
diff --git a/core/src/main/java/org/apache/ki/authc/pam/AllSuccessfulStrategy.java b/core/src/main/java/org/apache/ki/authc/pam/AllSuccessfulStrategy.java
index b617ca5..e5f4543 100644
--- a/core/src/main/java/org/apache/ki/authc/pam/AllSuccessfulStrategy.java
+++ b/core/src/main/java/org/apache/ki/authc/pam/AllSuccessfulStrategy.java
@@ -18,8 +18,8 @@
  */
 package org.apache.ki.authc.pam;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authc.AuthenticationException;
 import org.apache.ki.authc.AuthenticationInfo;
@@ -42,7 +42,7 @@
 public class AllSuccessfulStrategy extends AbstractAuthenticationStrategy {
 
     /** Private class log instance. */
-    private static final Log log = LogFactory.getLog(AllSuccessfulStrategy.class);
+    private static final Logger log = LoggerFactory.getLogger(AllSuccessfulStrategy.class);
 
     /**
      * Because all realms in this strategy must complete successfully, this implementation ensures that the given
diff --git a/core/src/main/java/org/apache/ki/authc/pam/ModularRealmAuthenticator.java b/core/src/main/java/org/apache/ki/authc/pam/ModularRealmAuthenticator.java
index 3520d1d..b1e1ce5 100644
--- a/core/src/main/java/org/apache/ki/authc/pam/ModularRealmAuthenticator.java
+++ b/core/src/main/java/org/apache/ki/authc/pam/ModularRealmAuthenticator.java
@@ -22,8 +22,8 @@
 import java.util.Collection;
 import java.util.List;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authc.AbstractAuthenticator;
 import org.apache.ki.authc.AuthenticationException;
@@ -74,7 +74,7 @@
     /*--------------------------------------------
     |             C O N S T A N T S             |
     ============================================*/
-    private static final Log log = LogFactory.getLog(ModularRealmAuthenticator.class);
+    private static final Logger log = LoggerFactory.getLogger(ModularRealmAuthenticator.class);
 
     /*--------------------------------------------
     |    I N S T A N C E   V A R I A B L E S    |
diff --git a/core/src/main/java/org/apache/ki/config/IniConfiguration.java b/core/src/main/java/org/apache/ki/config/IniConfiguration.java
index 96cec28..fbc288e 100644
--- a/core/src/main/java/org/apache/ki/config/IniConfiguration.java
+++ b/core/src/main/java/org/apache/ki/config/IniConfiguration.java
@@ -27,8 +27,8 @@
 import java.util.Map;

 import java.util.Scanner;

 

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 import org.apache.ki.KiException;

 import org.apache.ki.io.IniResource;

@@ -52,7 +52,7 @@
 

     //TODO - complete JavaDoc

 

-    private static final Log log = LogFactory.getLog(IniConfiguration.class);

+    private static final Logger log = LoggerFactory.getLogger(IniConfiguration.class);

 

     public static final String DEFAULT_INI_RESOURCE_PATH = "classpath:ki.ini";

 

diff --git a/core/src/main/java/org/apache/ki/config/ReflectionBuilder.java b/core/src/main/java/org/apache/ki/config/ReflectionBuilder.java
index e7b058c..f8bb81f 100644
--- a/core/src/main/java/org/apache/ki/config/ReflectionBuilder.java
+++ b/core/src/main/java/org/apache/ki/config/ReflectionBuilder.java
@@ -25,8 +25,8 @@
 

 import org.apache.commons.beanutils.BeanUtils;

 import org.apache.commons.beanutils.PropertyUtils;

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 import org.apache.ki.util.ClassUtils;

 import org.apache.ki.util.Nameable;

@@ -46,7 +46,7 @@
 

     //TODO - complete JavaDoc

 

-    private static final Log log = LogFactory.getLog(ReflectionBuilder.class);

+    private static final Logger log = LoggerFactory.getLogger(ReflectionBuilder.class);

 

     private static final String OBJECT_REFERENCE_BEGIN_TOKEN = "$";

     private static final String ESCAPED_OBJECT_REFERENCE_BEGIN_TOKEN = "\\$";

diff --git a/core/src/main/java/org/apache/ki/config/TextConfiguration.java b/core/src/main/java/org/apache/ki/config/TextConfiguration.java
index e9638a2..22f5be8 100644
--- a/core/src/main/java/org/apache/ki/config/TextConfiguration.java
+++ b/core/src/main/java/org/apache/ki/config/TextConfiguration.java
@@ -22,8 +22,8 @@
 import java.io.StringReader;

 import java.util.Scanner;

 

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 import org.apache.ki.KiException;

 import org.apache.ki.io.ResourceException;

@@ -38,7 +38,7 @@
  */

 public abstract class TextConfiguration extends ResourceConfiguration implements Initializable {

 

-    private static final Log log = LogFactory.getLog(TextConfiguration.class);    

+    private static final Logger log = LoggerFactory.getLogger(TextConfiguration.class);

 

     private String config;

 

diff --git a/core/src/main/java/org/apache/ki/crypto/BlowfishCipher.java b/core/src/main/java/org/apache/ki/crypto/BlowfishCipher.java
index d1ace30..697da89 100644
--- a/core/src/main/java/org/apache/ki/crypto/BlowfishCipher.java
+++ b/core/src/main/java/org/apache/ki/crypto/BlowfishCipher.java
@@ -25,8 +25,8 @@
 import javax.crypto.KeyGenerator;
 import javax.crypto.spec.SecretKeySpec;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.codec.Base64;
 import org.apache.ki.codec.CodecSupport;
@@ -77,7 +77,7 @@
     /**
      * Internal private log instance.
      */
-    private static final Log log = LogFactory.getLog(BlowfishCipher.class);
+    private static final Logger log = LoggerFactory.getLogger(BlowfishCipher.class);
 
     /**
      * The key to use by default, can be overridden by calling {@link #setKey(java.security.Key)}.
diff --git a/core/src/main/java/org/apache/ki/io/IniResource.java b/core/src/main/java/org/apache/ki/io/IniResource.java
index 7f06035..5b81b54 100644
--- a/core/src/main/java/org/apache/ki/io/IniResource.java
+++ b/core/src/main/java/org/apache/ki/io/IniResource.java
@@ -25,8 +25,8 @@
 import java.util.Map;

 import java.util.Scanner;

 

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 import static org.apache.ki.util.StringUtils.clean;

 import static org.apache.ki.util.StringUtils.splitKeyValue;

@@ -39,7 +39,7 @@
  */

 public class IniResource extends TextResource {

 

-    private static final Log log = LogFactory.getLog(IniResource.class);    

+    private static final Logger log = LoggerFactory.getLogger(IniResource.class);

 

     public static final String COMMENT_POUND = "#";

     public static final String COMMENT_SEMICOLON = ";";

diff --git a/core/src/main/java/org/apache/ki/io/ResourceUtils.java b/core/src/main/java/org/apache/ki/io/ResourceUtils.java
index 2b06aad..941887a 100644
--- a/core/src/main/java/org/apache/ki/io/ResourceUtils.java
+++ b/core/src/main/java/org/apache/ki/io/ResourceUtils.java
@@ -23,8 +23,8 @@
 import java.io.InputStream;
 import java.net.URL;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.util.ClassUtils;
 
@@ -52,7 +52,7 @@
     public static final String FILE_PREFIX = "file:";
 
     /** Private internal log instance. */
-    private static final Log log = LogFactory.getLog(ResourceUtils.class);
+    private static final Logger log = LoggerFactory.getLogger(ResourceUtils.class);
 
 
     /**
diff --git a/core/src/main/java/org/apache/ki/io/TextResource.java b/core/src/main/java/org/apache/ki/io/TextResource.java
index 8fc8fb6..5355bbf 100644
--- a/core/src/main/java/org/apache/ki/io/TextResource.java
+++ b/core/src/main/java/org/apache/ki/io/TextResource.java
@@ -25,8 +25,8 @@
 import java.io.Reader;

 import java.util.Scanner;

 

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 /**

  * //TODO complete JavaDoc

@@ -35,7 +35,7 @@
  */

 public abstract class TextResource extends AbstractResource {

 

-    private static final Log log = LogFactory.getLog(TextResource.class);    

+    private static final Logger log = LoggerFactory.getLogger(TextResource.class);

 

     protected String charsetName;

 

diff --git a/core/src/main/java/org/apache/ki/jndi/JndiLocator.java b/core/src/main/java/org/apache/ki/jndi/JndiLocator.java
index b2ff428..8636607 100644
--- a/core/src/main/java/org/apache/ki/jndi/JndiLocator.java
+++ b/core/src/main/java/org/apache/ki/jndi/JndiLocator.java
@@ -21,8 +21,8 @@
 import java.util.Properties;

 import javax.naming.NamingException;

 

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 /**

  * Convenient superclass for JNDI accessors, providing "jndiTemplate"

@@ -45,7 +45,7 @@
     /**

      * Private class log.

      */

-    private static final Log log = LogFactory.getLog(JndiLocator.class);

+    private static final Logger log = LoggerFactory.getLogger(JndiLocator.class);

 

     /**

      * JNDI prefix used in a J2EE container

diff --git a/core/src/main/java/org/apache/ki/jndi/JndiTemplate.java b/core/src/main/java/org/apache/ki/jndi/JndiTemplate.java
index aca3e7e..a9298e4 100644
--- a/core/src/main/java/org/apache/ki/jndi/JndiTemplate.java
+++ b/core/src/main/java/org/apache/ki/jndi/JndiTemplate.java
@@ -26,8 +26,8 @@
 import javax.naming.NameNotFoundException;

 import javax.naming.NamingException;

 

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 /**

  * Helper class that simplifies JNDI operations. It provides methods to lookup and

@@ -46,7 +46,7 @@
  */

 public class JndiTemplate {

 

-    private static final Log log = LogFactory.getLog(JndiTemplate.class);

+    private static final Logger log = LoggerFactory.getLogger(JndiTemplate.class);

 

     private Properties environment;

 

diff --git a/core/src/main/java/org/apache/ki/mgt/AbstractRememberMeManager.java b/core/src/main/java/org/apache/ki/mgt/AbstractRememberMeManager.java
index 7f47845..5cc9333 100644
--- a/core/src/main/java/org/apache/ki/mgt/AbstractRememberMeManager.java
+++ b/core/src/main/java/org/apache/ki/mgt/AbstractRememberMeManager.java
@@ -18,8 +18,8 @@
  */
 package org.apache.ki.mgt;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authc.AuthenticationException;
 import org.apache.ki.authc.AuthenticationInfo;
@@ -53,7 +53,7 @@
     /**
      * private inner log instance.
      */
-    private static final Log log = LogFactory.getLog(AbstractRememberMeManager.class);
+    private static final Logger log = LoggerFactory.getLogger(AbstractRememberMeManager.class);
 
     private Serializer serializer = new DefaultSerializer();
     private Cipher cipher = new BlowfishCipher();
diff --git a/core/src/main/java/org/apache/ki/mgt/DefaultSecurityManager.java b/core/src/main/java/org/apache/ki/mgt/DefaultSecurityManager.java
index 974fd37..48ad928 100644
--- a/core/src/main/java/org/apache/ki/mgt/DefaultSecurityManager.java
+++ b/core/src/main/java/org/apache/ki/mgt/DefaultSecurityManager.java
@@ -22,8 +22,8 @@
 import java.net.InetAddress;
 import java.util.Collection;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authc.AuthenticationException;
 import org.apache.ki.authc.AuthenticationInfo;
@@ -79,7 +79,7 @@
 
     //TODO - complete JavaDoc
 
-    private static final Log log = LogFactory.getLog(DefaultSecurityManager.class);
+    private static final Logger log = LoggerFactory.getLogger(DefaultSecurityManager.class);
 
     protected RememberMeManager rememberMeManager;
 
@@ -193,10 +193,14 @@
         getRememberMeManagerForCipherAttributes().setDecryptionCipherKeyBase64(base64);
     }
 
+    protected Serializable getCurrentSessionId() {
+        return ThreadContext.getSessionId();
+    }
+
     protected Subject createSubject() {
         Subject subject = null;
 
-        Serializable sessionId = ThreadContext.getSessionId();
+        Serializable sessionId = getCurrentSessionId();
         if (sessionId != null) {
             try {
                 subject = getSubjectBySessionId(sessionId);
diff --git a/core/src/main/java/org/apache/ki/mgt/SessionsSecurityManager.java b/core/src/main/java/org/apache/ki/mgt/SessionsSecurityManager.java
index ccdd829..23fca6f 100644
--- a/core/src/main/java/org/apache/ki/mgt/SessionsSecurityManager.java
+++ b/core/src/main/java/org/apache/ki/mgt/SessionsSecurityManager.java
@@ -18,11 +18,6 @@
  */
 package org.apache.ki.mgt;
 
-import java.io.Serializable;
-import java.net.InetAddress;
-import java.util.Collection;
-import java.util.Date;
-
 import org.apache.ki.authz.HostUnauthorizedException;
 import org.apache.ki.cache.CacheManagerAware;
 import org.apache.ki.session.InvalidSessionException;
@@ -35,6 +30,11 @@
 import org.apache.ki.session.mgt.SessionManager;
 import org.apache.ki.util.LifecycleUtils;
 
+import java.io.Serializable;
+import java.net.InetAddress;
+import java.util.Collection;
+import java.util.Date;
+
 
 /**
  * Ki support of a {@link SecurityManager} class hierarchy that delegates all
@@ -73,11 +73,11 @@
     /**
      * Sets the underlying delegate {@link SessionManager} instance that will be used to support this implementation's
      * <tt>SessionManager</tt> method calls.
-     *
+     * <p/>
      * <p>This <tt>SecurityManager</tt> implementation does not provide logic to support the inherited
      * <tt>SessionManager</tt> interface, but instead delegates these calls to an internal
      * <tt>SessionManager</tt> instance.
-     *
+     * <p/>
      * <p>If a <tt>SessionManager</tt> instance is not set, a default one will be automatically created and
      * initialized appropriately for the the existing runtime environment.
      *
@@ -128,11 +128,11 @@
     /**
      * This is a convenience method that allows registration of SessionListeners with the underlying delegate
      * SessionManager at startup.
-     *
+     * <p/>
      * <p>This is more convenient than having to configure your own SessionManager instance, inject the listeners on
      * it, and then set that SessionManager instance as an attribute of this class.  Instead, you can just rely
      * on the <tt>SecurityManager</tt> to apply these <tt>SessionListener</tt>s on your behalf.
-     *
+     * <p/>
      * <p>One notice however: The underlying SessionManager delegate must implement the
      * {@link SessionListenerRegistrar SessionListenerRegistrar} interface in order for these listeners to
      * be applied.  If it does not implement this interface, it is considered a configuration error and an exception
@@ -152,13 +152,13 @@
         }
         if (!(requiredType.isInstance(this.sessionManager))) {
             String msg = "Property configuration failed.  The target property is only configurable when the " +
-                    "underlying SessionManager instance is a part of the " +
-                    "[" + requiredType.getName() + "] class hierarchy.  " +
-                    "The current SessionManager is of type [" + this.sessionManager.getClass().getName() + "].  " +
-                    "This might occur for example if you're trying to set the validation interval or auto session " +
-                    "creation in a servlet container-backed session environment ('http' session mode).  If that is " +
-                    "the case however, that property is only useful when using 'ki' session mode and using " +
-                    "Ki enterprise sessions which do not rely on a servlet container.";
+                "underlying SessionManager instance is a part of the " +
+                "[" + requiredType.getName() + "] class hierarchy.  " +
+                "The current SessionManager is of type [" + this.sessionManager.getClass().getName() + "].  " +
+                "This might occur for example if you're trying to set the validation interval or auto session " +
+                "creation in a servlet container-backed session environment ('http' session mode).  If that is " +
+                "the case however, that property is only useful when using 'ki' session mode and using " +
+                "Ki enterprise sessions which do not rely on a servlet container.";
             throw new IllegalStateException(msg);
         }
     }
@@ -208,11 +208,11 @@
      *
      * @param autoCreate if the wrapped {@link AbstractValidatingSessionManager} should automatically create a new
      *                   session when an invalid session is referenced
-     * @see org.apache.ki.session.mgt.AbstractValidatingSessionManager#setAutoCreateAfterInvalidation(boolean)
+     * @see org.apache.ki.session.mgt.AbstractValidatingSessionManager#setAutoCreateWhenInvalid(boolean)
      */
     public void setAutoCreateSessionAfterInvalidation(boolean autoCreate) {
         assertSessionManager(AbstractValidatingSessionManager.class);
-        ((AbstractValidatingSessionManager) this.sessionManager).setAutoCreateAfterInvalidation(autoCreate);
+        ((AbstractValidatingSessionManager) this.sessionManager).setAutoCreateWhenInvalid(autoCreate);
     }
 
     /**
@@ -229,11 +229,11 @@
      *
      * @return <code>true</code> if this session manager should automatically create a new session when an invalid
      *         session is referenced, <code>false</code> otherwise.
-     * @see org.apache.ki.session.mgt.AbstractValidatingSessionManager#isAutoCreateAfterInvalidation()
+     * @see org.apache.ki.session.mgt.AbstractValidatingSessionManager#isAutoCreateWhenInvalid()
      */
     public boolean isAutoCreateSessionAfterInvalidation() {
         assertSessionManager(AbstractValidatingSessionManager.class);
-        return ((AbstractValidatingSessionManager) this.sessionManager).isAutoCreateAfterInvalidation();
+        return ((AbstractValidatingSessionManager) this.sessionManager).isAutoCreateWhenInvalid();
     }
 
     /**
@@ -247,9 +247,9 @@
     private void assertSessionListenerSupport() throws IllegalStateException {
         if (!(this.sessionManager instanceof SessionListenerRegistrar)) {
             String msg = "SessionListener registration failed:  The underlying SessionManager instance of " +
-                    "type [" + sessionManager.getClass().getName() + "] does not implement the " +
-                    SessionListenerRegistrar.class.getName() + " interface and therefore cannot support " +
-                    "session notifications.";
+                "type [" + sessionManager.getClass().getName() + "] does not implement the " +
+                SessionListenerRegistrar.class.getName() + " interface and therefore cannot support " +
+                "session notifications.";
             throw new IllegalStateException(msg);
         }
     }
@@ -277,7 +277,7 @@
      */
     public boolean remove(SessionListener listener) {
         return (this.sessionManager instanceof SessionListenerRegistrar) &&
-                ((SessionListenerRegistrar) this.sessionManager).remove(listener);
+            ((SessionListenerRegistrar) this.sessionManager).remove(listener);
     }
 
     public Serializable start(InetAddress originatingHost) throws HostUnauthorizedException, IllegalArgumentException {
@@ -336,5 +336,4 @@
         LifecycleUtils.destroy(getSessionManager());
         this.sessionManager = null;
     }
-
 }
diff --git a/core/src/main/java/org/apache/ki/mgt/ThreadContextSubjectBinder.java b/core/src/main/java/org/apache/ki/mgt/ThreadContextSubjectBinder.java
index 8a3a624..7e6fa55 100644
--- a/core/src/main/java/org/apache/ki/mgt/ThreadContextSubjectBinder.java
+++ b/core/src/main/java/org/apache/ki/mgt/ThreadContextSubjectBinder.java
@@ -18,13 +18,12 @@
  */
 package org.apache.ki.mgt;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.subject.Subject;
 import org.apache.ki.util.ThreadContext;
 
-
 /**
  * Associates a {@link Subject Subject} instance to the currently executing thread via the {
  *
@@ -36,7 +35,7 @@
  */
 public class ThreadContextSubjectBinder implements SubjectBinder {
 
-    private static final Log log = LogFactory.getLog(ThreadContextSubjectBinder.class);
+    private static final Logger log = LoggerFactory.getLogger(ThreadContextSubjectBinder.class);
 
     /**
      * This implementation returns the {@link Subject Subject} from the {@link ThreadContext ThreadContext}.
diff --git a/core/src/main/java/org/apache/ki/realm/AuthenticatingRealm.java b/core/src/main/java/org/apache/ki/realm/AuthenticatingRealm.java
index f301897..b759b8e 100644
--- a/core/src/main/java/org/apache/ki/realm/AuthenticatingRealm.java
+++ b/core/src/main/java/org/apache/ki/realm/AuthenticatingRealm.java
@@ -18,8 +18,8 @@
  */
 package org.apache.ki.realm;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authc.AuthenticationException;
 import org.apache.ki.authc.AuthenticationInfo;
@@ -59,7 +59,7 @@
 
     //TODO - complete JavaDoc
 
-    private static final Log log = LogFactory.getLog(AuthenticatingRealm.class);
+    private static final Logger log = LoggerFactory.getLogger(AuthenticatingRealm.class);
 
     /**
      * Password matcher used to determine if the provided password matches
diff --git a/core/src/main/java/org/apache/ki/realm/AuthorizingRealm.java b/core/src/main/java/org/apache/ki/realm/AuthorizingRealm.java
index 6fd7c2c..deb8bf1 100644
--- a/core/src/main/java/org/apache/ki/realm/AuthorizingRealm.java
+++ b/core/src/main/java/org/apache/ki/realm/AuthorizingRealm.java
@@ -25,8 +25,8 @@
 import java.util.List;
 import java.util.Set;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authc.credential.CredentialsMatcher;
 import org.apache.ki.authz.AuthorizationException;
@@ -71,7 +71,7 @@
     /*--------------------------------------------
     |             C O N S T A N T S             |
     ============================================*/
-    private static final Log log = LogFactory.getLog(AuthorizingRealm.class);
+    private static final Logger log = LoggerFactory.getLogger(AuthorizingRealm.class);
 
     /**
      * The default postfix appended to the realm name for caching AuthorizationInfos.
diff --git a/core/src/main/java/org/apache/ki/realm/activedirectory/ActiveDirectoryRealm.java b/core/src/main/java/org/apache/ki/realm/activedirectory/ActiveDirectoryRealm.java
index fd6d6d3..753d4fe 100644
--- a/core/src/main/java/org/apache/ki/realm/activedirectory/ActiveDirectoryRealm.java
+++ b/core/src/main/java/org/apache/ki/realm/activedirectory/ActiveDirectoryRealm.java
@@ -31,8 +31,8 @@
 import javax.naming.directory.SearchResult;
 import javax.naming.ldap.LdapContext;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authc.AuthenticationInfo;
 import org.apache.ki.authc.AuthenticationToken;
@@ -65,7 +65,7 @@
     |             C O N S T A N T S             |
     ============================================*/
 
-    private static final Log log = LogFactory.getLog(ActiveDirectoryRealm.class);    
+    private static final Logger log = LoggerFactory.getLogger(ActiveDirectoryRealm.class);
 
     private static final String ROLE_NAMES_DELIMETER = ",";
 
diff --git a/core/src/main/java/org/apache/ki/realm/jdbc/JdbcRealm.java b/core/src/main/java/org/apache/ki/realm/jdbc/JdbcRealm.java
index 2bd1a1d..5307ef3 100644
--- a/core/src/main/java/org/apache/ki/realm/jdbc/JdbcRealm.java
+++ b/core/src/main/java/org/apache/ki/realm/jdbc/JdbcRealm.java
@@ -27,8 +27,8 @@
 import java.util.Set;
 import javax.sql.DataSource;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authc.AccountException;
 import org.apache.ki.authc.AuthenticationException;
@@ -88,7 +88,7 @@
      */
     protected static final String DEFAULT_PERMISSIONS_QUERY = "select permission from roles_permissions where role_name = ?";
 
-    private static final Log log = LogFactory.getLog(JdbcRealm.class);    
+    private static final Logger log = LoggerFactory.getLogger(JdbcRealm.class);
 
     /*--------------------------------------------
     |    I N S T A N C E   V A R I A B L E S    |
diff --git a/core/src/main/java/org/apache/ki/realm/ldap/AbstractLdapRealm.java b/core/src/main/java/org/apache/ki/realm/ldap/AbstractLdapRealm.java
index 83f6963..0a1d119 100644
--- a/core/src/main/java/org/apache/ki/realm/ldap/AbstractLdapRealm.java
+++ b/core/src/main/java/org/apache/ki/realm/ldap/AbstractLdapRealm.java
@@ -20,8 +20,8 @@
 
 import javax.naming.NamingException;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authc.AuthenticationException;
 import org.apache.ki.authc.AuthenticationInfo;
@@ -60,7 +60,7 @@
     |             C O N S T A N T S             |
     ============================================*/
 
-    private static final Log log = LogFactory.getLog(AbstractLdapRealm.class);    
+    private static final Logger log = LoggerFactory.getLogger(AbstractLdapRealm.class);
 
     /*--------------------------------------------
     |    I N S T A N C E   V A R I A B L E S    |
diff --git a/core/src/main/java/org/apache/ki/realm/ldap/DefaultLdapContextFactory.java b/core/src/main/java/org/apache/ki/realm/ldap/DefaultLdapContextFactory.java
index 571718f..ed3a4cf 100644
--- a/core/src/main/java/org/apache/ki/realm/ldap/DefaultLdapContextFactory.java
+++ b/core/src/main/java/org/apache/ki/realm/ldap/DefaultLdapContextFactory.java
@@ -25,8 +25,8 @@
 import javax.naming.ldap.InitialLdapContext;
 import javax.naming.ldap.LdapContext;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * <p>Default implementation of {@link LdapContextFactory} that can be configured or extended to
@@ -58,7 +58,7 @@
     |    I N S T A N C E   V A R I A B L E S    |
     ============================================*/
 
-    private static final Log log = LogFactory.getLog(DefaultLdapContextFactory.class);
+    private static final Logger log = LoggerFactory.getLogger(DefaultLdapContextFactory.class);
 
     protected String authentication = "simple";
 
diff --git a/core/src/main/java/org/apache/ki/realm/ldap/LdapUtils.java b/core/src/main/java/org/apache/ki/realm/ldap/LdapUtils.java
index 38708b6..dc1d891 100644
--- a/core/src/main/java/org/apache/ki/realm/ldap/LdapUtils.java
+++ b/core/src/main/java/org/apache/ki/realm/ldap/LdapUtils.java
@@ -26,8 +26,8 @@
 import javax.naming.directory.Attribute;
 import javax.naming.ldap.LdapContext;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * Utility class providing static methods to make working with LDAP
@@ -39,7 +39,7 @@
 public class LdapUtils {
 
     /** Private internal log instance. */
-    private static final Log log = LogFactory.getLog(LdapUtils.class);
+    private static final Logger log = LoggerFactory.getLogger(LdapUtils.class);
 
     /**
      * Private constructor to prevent instantiation
diff --git a/core/src/main/java/org/apache/ki/realm/text/PropertiesRealm.java b/core/src/main/java/org/apache/ki/realm/text/PropertiesRealm.java
index 7359d14..2e594c8 100644
--- a/core/src/main/java/org/apache/ki/realm/text/PropertiesRealm.java
+++ b/core/src/main/java/org/apache/ki/realm/text/PropertiesRealm.java
@@ -28,8 +28,8 @@
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.KiException;
 import org.apache.ki.cache.CacheManager;
@@ -110,7 +110,7 @@
     /*--------------------------------------------
     |    I N S T A N C E   V A R I A B L E S    |
     ============================================*/
-    private static final Log log = LogFactory.getLog(PropertiesRealm.class);
+    private static final Logger log = LoggerFactory.getLogger(PropertiesRealm.class);
 
     protected ExecutorService scheduler = null;
     protected boolean useXmlFormat = false;
diff --git a/core/src/main/java/org/apache/ki/session/mgt/AbstractSessionManager.java b/core/src/main/java/org/apache/ki/session/mgt/AbstractSessionManager.java
index 013b625..2fd9e88 100644
--- a/core/src/main/java/org/apache/ki/session/mgt/AbstractSessionManager.java
+++ b/core/src/main/java/org/apache/ki/session/mgt/AbstractSessionManager.java
@@ -24,8 +24,8 @@
 import java.util.Collection;
 import java.util.Date;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authz.HostUnauthorizedException;
 import org.apache.ki.session.InvalidSessionException;
@@ -47,12 +47,10 @@
     protected static final long MILLIS_PER_MINUTE = 60 * MILLIS_PER_SECOND;
     protected static final long MILLIS_PER_HOUR = 60 * MILLIS_PER_MINUTE;
 
-    /**
-     * Default main session timeout value, equal to {@code 30} minutes.
-     */
+    /** Default main session timeout value, equal to {@code 30} minutes. */
     public static final long DEFAULT_GLOBAL_SESSION_TIMEOUT = 30 * MILLIS_PER_MINUTE;
 
-    private static final Log log = LogFactory.getLog(AbstractSessionManager.class);
+    private static final Logger log = LoggerFactory.getLogger(AbstractSessionManager.class);
 
     private long globalSessionTimeout = DEFAULT_GLOBAL_SESSION_TIMEOUT;
     private Collection<SessionListener> listeners = new ArrayList<SessionListener>();
@@ -83,7 +81,7 @@
      * Sets the system-wide default time in milliseconds that any session may remain idle before expiring. This
      * value is the main default for all sessions and may be overridden on a <em>per-session</em> basis by calling
      * {@code Subject.getSession().}{@link Session#setTimeout setTimeout(long)} if so desired.
-     *
+     * <p/>
      * <ul>
      * <li>A negative return value means sessions never expire.</li>
      * <li>A non-negative return value (0 or greater) means session timeout will occur as expected.</li>
@@ -115,10 +113,12 @@
 
     public Serializable start(InetAddress originatingHost) throws HostUnauthorizedException, IllegalArgumentException {
         Session session = createSession(originatingHost);
+        onStart(session);
         notifyStart(session);
         return session.getId();
     }
 
+
     /**
      * Returns the session instance to use to pass to registered <code>SessionListener</code>s for notification
      * that the session has been invalidated (stopped or expired).
@@ -192,17 +192,9 @@
         if (log.isDebugEnabled()) {
             log.debug("Stopping session with id [" + session.getId() + "]");
         }
-        notifyStop(session);
         session.stop();
         onStop(session);
-    }
-
-    protected void onStop(Session session) {
-        onChange(session);
-    }
-
-    protected void onExpiration(Session session) {
-        onChange(session);
+        notifyStop(session);
     }
 
     public Collection<Object> getAttributeKeys(Serializable sessionId) {
@@ -242,7 +234,29 @@
     }
 
     public boolean isValid(Serializable sessionId) {
-        return doGetSession(sessionId) != null;
+        try {
+            return getSession(sessionId) != null;
+        } catch (InvalidSessionException e) {
+            return false;
+        }
+    }
+
+    /**
+     * Template method that allows subclasses to react to a new session being created.
+     * <p/>
+     * This method is invoked <em>before</em> any session listeners are notified.
+     *
+     * @param session the session that was just {@link #createSession created}.
+     */
+    protected void onStart(Session session) {
+    }
+
+    protected void onStop(Session session) {
+        onChange(session);
+    }
+
+    protected void onExpiration(Session session) {
+        onChange(session);
     }
 
     protected void onChange(Session s) {
diff --git a/core/src/main/java/org/apache/ki/session/mgt/AbstractValidatingSessionManager.java b/core/src/main/java/org/apache/ki/session/mgt/AbstractValidatingSessionManager.java
index de9149f..0e6aff7 100644
--- a/core/src/main/java/org/apache/ki/session/mgt/AbstractValidatingSessionManager.java
+++ b/core/src/main/java/org/apache/ki/session/mgt/AbstractValidatingSessionManager.java
@@ -22,15 +22,17 @@
 import java.net.InetAddress;
 import java.util.Collection;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authz.HostUnauthorizedException;
 import org.apache.ki.session.ExpiredSessionException;
 import org.apache.ki.session.InvalidSessionException;
 import org.apache.ki.session.Session;
+import org.apache.ki.session.ReplacedSessionException;
 import org.apache.ki.util.Destroyable;
 import org.apache.ki.util.LifecycleUtils;
+import org.apache.ki.util.ThreadContext;
 
 
 /**
@@ -41,11 +43,11 @@
  * @since 0.1
  */
 public abstract class AbstractValidatingSessionManager extends AbstractSessionManager
-        implements ValidatingSessionManager, Destroyable {
+    implements ValidatingSessionManager, Destroyable {
 
     //TODO - complete JavaDoc
 
-    private static final Log log = LogFactory.getLog(AbstractValidatingSessionManager.class);
+    private static final Logger log = LoggerFactory.getLogger(AbstractValidatingSessionManager.class);
 
     /**
      * The default interval at which sessions will be validated (1 hour);
@@ -54,19 +56,16 @@
     public static final long DEFAULT_SESSION_VALIDATION_INTERVAL = MILLIS_PER_HOUR;
 
     protected boolean sessionValidationSchedulerEnabled = true; //default
-    /**
-     * Scheduler used to validate sessions on a regular basis.
-     */
+    /** Scheduler used to validate sessions on a regular basis. */
     protected SessionValidationScheduler sessionValidationScheduler = null;
 
     protected long sessionValidationInterval = DEFAULT_SESSION_VALIDATION_INTERVAL;
 
     /**
-     * Whether or not to automatically create a new session transparently when a referenced session has expired.
-     * True by default, for developer convenience.
+     * Whether or not to automatically create a new session transparently when a referenced session is invalid or
+     * did not exist.  {@code true} by default, for developer convenience.
      */
-    private boolean autoCreateAfterInvalidation = true;
-
+    private boolean autoCreateWhenInvalid = true;
 
     public AbstractValidatingSessionManager() {
     }
@@ -100,10 +99,10 @@
      * never called) , this method allows one to specify how
      * frequently session should be validated (to check for orphans).  The default value is
      * {@link #DEFAULT_SESSION_VALIDATION_INTERVAL}.
-     *
+     * <p/>
      * <p>If you override the default scheduler, it is assumed that overriding instance 'knows' how often to
      * validate sessions, and this attribute will be ignored.
-     *
+     * <p/>
      * <p>Unless this method is called, the default value is {@link #DEFAULT_SESSION_VALIDATION_INTERVAL}.
      *
      * @param sessionValidationInterval the time in milliseconds between checking for valid sessions to reap orphans.
@@ -117,9 +116,9 @@
     }
 
     /**
-     * Returns <code>true</code> if this session manager should automatically create a new session when an invalid
-     * session is referenced, <code>false</code> otherwise.  Unless overridden by the
-     * {@link #setAutoCreateAfterInvalidation(boolean)} method, the default value is <code>true</code> for developer
+     * Returns <code>true</code> if this session manager should automatically create a new session when an invalid or
+     * nonexistent session is referenced, <code>false</code> otherwise.  Unless overridden by the
+     * {@link #setAutoCreateWhenInvalid(boolean)} method, the default value is <code>true</code> for developer
      * convenience and to match what most people are accustomed based on years of servlet container behavior.
      * <p/>
      * When true (the default), this {@code SessionManager} implementation throws an
@@ -130,8 +129,8 @@
      * @return <code>true</code> if this session manager should automatically create a new session when an invalid
      *         session is referenced, <code>false</code> otherwise.
      */
-    public boolean isAutoCreateAfterInvalidation() {
-        return autoCreateAfterInvalidation;
+    public boolean isAutoCreateWhenInvalid() {
+        return autoCreateWhenInvalid;
     }
 
     /**
@@ -144,18 +143,54 @@
      * the caller can receive the new session ID and react accordingly for future {@code SessionManager SessionManager}
      * method invocations.
      *
-     * @param autoCreateAfterInvalidation if this session manager should automatically create a new session when an
+     * @param autoCreateWhenInvalid if this session manager should automatically create a new session when an
      *                                    invalid session is referenced
      */
-    public void setAutoCreateAfterInvalidation(boolean autoCreateAfterInvalidation) {
-        this.autoCreateAfterInvalidation = autoCreateAfterInvalidation;
+    public void setAutoCreateWhenInvalid(boolean autoCreateWhenInvalid) {
+        this.autoCreateWhenInvalid = autoCreateWhenInvalid;
     }
 
     protected final Session doGetSession(Serializable sessionId) throws InvalidSessionException {
         enableSessionValidationIfNecessary();
-        return retrieveSession(sessionId);
+
+        if (log.isTraceEnabled()) {
+            log.trace("Attempting to retrieve session with id [" + sessionId + "]");
+        }
+        InetAddress hostAddress = null;
+        try {
+            Session s = retrieveSession(sessionId);
+            //save the host address in case the session will be invalidated.  We want to retain it for the
+            //replacement session:
+            hostAddress = s.getHostAddress();
+            validate(s);
+            return s;
+        } catch (InvalidSessionException ise) {
+            if (isAutoCreateWhenInvalid()) {
+                if (hostAddress == null) {
+                    //try the threadContext as a last resort:
+                    hostAddress = ThreadContext.getInetAddress();
+                }
+                Serializable newId = start(hostAddress);
+                String msg = "Session with id [" + sessionId + "] is invalid.  The SessionManager " +
+                    "has been configured to automatically re-create sessions upon invalidation.  Returnining " +
+                    "new session id [" + newId + "] with exception so the caller may react accordingly.";
+                throw new ReplacedSessionException(msg, ise, sessionId, newId);
+            } else {
+                //propagate original exception:
+                throw ise;
+            }
+        }
     }
 
+
+
+    /**
+     * Looks up a session from the underlying data store based on the specified {@code sessionId}.
+     *
+     * @param sessionId
+     * @return
+     * @throws InvalidSessionException
+     */
     protected abstract Session retrieveSession(Serializable sessionId) throws InvalidSessionException;
 
     protected final Session createSession(InetAddress originatingHost) throws HostUnauthorizedException, IllegalArgumentException {
@@ -166,20 +201,24 @@
     protected abstract Session doCreateSession(InetAddress originatingHost) throws HostUnauthorizedException, IllegalArgumentException;
 
     protected void validate(Session session) throws InvalidSessionException {
+        try {
+            doValidate(session);
+        } catch (ExpiredSessionException ese) {
+            onExpiration(session);            
+            notifyExpiration(session);
+            //propagate to caller:
+            throw ese;
+        }
+    }
+
+    protected void doValidate(Session session) throws InvalidSessionException {
         if (session instanceof ValidatingSession) {
-            try {
-                ((ValidatingSession) session).validate();
-            } catch (ExpiredSessionException ese) {
-                notifyExpiration(session);
-                onExpiration(session);
-                //propagate to caller:
-                throw ese;
-            }
+            ((ValidatingSession) session).validate();
         } else {
             String msg = "The " + getClass().getName() + " implementation only supports validating " +
-                    "Session implementations of the " + ValidatingSession.class.getName() + " interface.  " +
-                    "Please either implement this interface in your session implementation or override the " +
-                    getClass().getName() + ".validate(Session) method to perform validation.";
+                "Session implementations of the " + ValidatingSession.class.getName() + " interface.  " +
+                "Please either implement this interface in your session implementation or override the " +
+                getClass().getName() + ".validate(Session) method to perform validation.";
             throw new IllegalStateException(msg);
         }
     }
@@ -187,7 +226,7 @@
     /**
      * Subclass template hook in case per-session timeout is not based on
      * {@link org.apache.ki.session.Session#getTimeout()}.
-     *
+     * <p/>
      * <p>This implementation merely returns {@link org.apache.ki.session.Session#getTimeout()}</p>
      *
      * @param session the session for which to determine session timeout.
@@ -254,9 +293,7 @@
         disableSessionValidation();
     }
 
-    /**
-     * @see ValidatingSessionManager#validateSessions()
-     */
+    /** @see ValidatingSessionManager#validateSessions() */
     public void validateSessions() {
         if (log.isInfoEnabled()) {
             log.info("Validating all active sessions...");
@@ -274,7 +311,7 @@
                     if (log.isDebugEnabled()) {
                         boolean expired = (e instanceof ExpiredSessionException);
                         String msg = "Invalidated session with id [" + s.getId() + "]" +
-                                (expired ? " (expired)" : " (stopped)");
+                            (expired ? " (expired)" : " (stopped)");
                         log.debug(msg);
                     }
                     invalidCount++;
diff --git a/core/src/main/java/org/apache/ki/session/mgt/DefaultSessionManager.java b/core/src/main/java/org/apache/ki/session/mgt/DefaultSessionManager.java
index b192b7f..c288750 100644
--- a/core/src/main/java/org/apache/ki/session/mgt/DefaultSessionManager.java
+++ b/core/src/main/java/org/apache/ki/session/mgt/DefaultSessionManager.java
@@ -18,27 +18,25 @@
  */
 package org.apache.ki.session.mgt;
 
+import org.apache.ki.cache.CacheManager;
+import org.apache.ki.cache.CacheManagerAware;
+import org.apache.ki.session.InvalidSessionException;
+import org.apache.ki.session.Session;
+import org.apache.ki.session.mgt.eis.MemorySessionDAO;
+import org.apache.ki.session.mgt.eis.SessionDAO;
+import org.apache.ki.util.CollectionUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 import java.io.Serializable;
 import java.net.InetAddress;
 import java.util.Collection;
 import java.util.Date;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-import org.apache.ki.cache.CacheManager;
-import org.apache.ki.cache.CacheManagerAware;
-import org.apache.ki.session.InvalidSessionException;
-import org.apache.ki.session.ReplacedSessionException;
-import org.apache.ki.session.Session;
-import org.apache.ki.session.mgt.eis.MemorySessionDAO;
-import org.apache.ki.session.mgt.eis.SessionDAO;
-import org.apache.ki.util.CollectionUtils;
-import org.apache.ki.util.ThreadContext;
-
 
 /**
- * Default business-tier implementation of the {@link ValidatingSessionManager} interface.
+ * Default business-tier implementation of a {@link ValidatingSessionManager}.  All session CRUD operations are
+ * delegated to an internal {@link SessionDAO}.
  *
  * @author Les Hazlewood
  * @since 0.1
@@ -47,7 +45,7 @@
 
     //TODO - complete JavaDoc
 
-    private static final Log log = LogFactory.getLog(DefaultSessionManager.class);
+    private static final Logger log = LoggerFactory.getLogger(DefaultSessionManager.class);
 
     protected SessionDAO sessionDAO;
 
@@ -91,10 +89,11 @@
 
     protected void onStop(Session session) {
         if (session instanceof SimpleSession) {
-            Date stopTs = ((SimpleSession) session).getStopTimestamp();
-            ((SimpleSession) session).setLastAccessTime(stopTs);
+            SimpleSession ss = (SimpleSession)session;
+            Date stopTs = ss.getStopTimestamp();
+            ss.setLastAccessTime(stopTs);
         }
-        super.onStop(session);
+        onChange(session);
     }
 
     protected void onExpiration(Session session) {
@@ -112,30 +111,11 @@
         if (log.isTraceEnabled()) {
             log.trace("Attempting to retrieve session with id [" + sessionId + "]");
         }
-        InetAddress hostAddress = null;
-        try {
-            Session s = sessionDAO.readSession(sessionId);
-            //save the host address in case the session will be invalidated.  We want to retain it for the
-            //replacement session:
-            hostAddress = s.getHostAddress();
-            validate(s);
-            return s;
-        } catch (InvalidSessionException ise) {
-            if (isAutoCreateAfterInvalidation()) {
-                if (hostAddress == null) {
-                    //try the threadContext as a last resort:
-                    hostAddress = ThreadContext.getInetAddress();
-                }
-                Serializable newId = start(hostAddress);
-                String msg = "Session with id [" + sessionId + "] is invalid.  The SessionManager " +
-                        "has been configured to automatically re-create sessions upon invalidation.  Returnining " +
-                        "new session id [" + newId + "] with exception so the caller may react accordingly.";
-                throw new ReplacedSessionException(msg, ise, sessionId, newId);
-            } else {
-                //propagate original exception:
-                throw ise;
-            }
-        }
+        return retrieveSessionFromDataSource(sessionId);
+    }
+
+    protected Session retrieveSessionFromDataSource(Serializable sessionId) throws InvalidSessionException {
+        return sessionDAO.readSession(sessionId);
     }
 
     protected Collection<Session> getActiveSessions() {
diff --git a/core/src/main/java/org/apache/ki/session/mgt/ExecutorServiceSessionValidationScheduler.java b/core/src/main/java/org/apache/ki/session/mgt/ExecutorServiceSessionValidationScheduler.java
index 217d771..e77c1b3 100644
--- a/core/src/main/java/org/apache/ki/session/mgt/ExecutorServiceSessionValidationScheduler.java
+++ b/core/src/main/java/org/apache/ki/session/mgt/ExecutorServiceSessionValidationScheduler.java
@@ -22,8 +22,8 @@
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 
 /**
@@ -39,7 +39,7 @@
     //TODO - complete JavaDoc
 
     /** Private internal log instance. */
-    private static final Log log = LogFactory.getLog(ExecutorServiceSessionValidationScheduler.class);
+    private static final Logger log = LoggerFactory.getLogger(ExecutorServiceSessionValidationScheduler.class);
 
     ValidatingSessionManager sessionManager;
     private ScheduledExecutorService service;
diff --git a/core/src/main/java/org/apache/ki/session/mgt/LocalSessionManager.java b/core/src/main/java/org/apache/ki/session/mgt/LocalSessionManager.java
new file mode 100644
index 0000000..b0e00d1
--- /dev/null
+++ b/core/src/main/java/org/apache/ki/session/mgt/LocalSessionManager.java
@@ -0,0 +1,24 @@
+package org.apache.ki.session.mgt;
+
+import org.apache.ki.session.Session;
+
+/**
+ * A {@code SessionManager} that is available in a local VM only.  It is not intended to be accessible
+ * in remoting scenarios.
+ *
+ * @author Les Hazlewood
+ * @since Mar 26, 2009 2:34:44 PM
+ */
+public interface LocalSessionManager extends SessionManager {
+
+    /**
+     * Returns the currently accessible {@link Session} based on the runtime environment.  This is mostly
+     * returned from a ThreadLocal, static memory or based on thread-bound Request/Response pair in a Web
+     * environment.
+     *
+     * @return the currently accessible {@link Session} based on the runtime environment.
+     */
+    Session getCurrentSession();
+
+
+}
diff --git a/core/src/main/java/org/apache/ki/session/mgt/SimpleSession.java b/core/src/main/java/org/apache/ki/session/mgt/SimpleSession.java
index 57c6a10..284a0ec 100644
--- a/core/src/main/java/org/apache/ki/session/mgt/SimpleSession.java
+++ b/core/src/main/java/org/apache/ki/session/mgt/SimpleSession.java
@@ -28,8 +28,8 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.session.ExpiredSessionException;
 import org.apache.ki.session.InvalidSessionException;
@@ -50,7 +50,7 @@
     protected static final long MILLIS_PER_MINUTE = 60 * MILLIS_PER_SECOND;
     protected static final long MILLIS_PER_HOUR = 60 * MILLIS_PER_MINUTE;
 
-    private transient static final Log log = LogFactory.getLog(SimpleSession.class);
+    private transient static final Logger log = LoggerFactory.getLogger(SimpleSession.class);
 
 
     private Serializable id = null;
diff --git a/core/src/main/java/org/apache/ki/session/mgt/eis/MemorySessionDAO.java b/core/src/main/java/org/apache/ki/session/mgt/eis/MemorySessionDAO.java
index 18963c3..5f1f5d1 100644
--- a/core/src/main/java/org/apache/ki/session/mgt/eis/MemorySessionDAO.java
+++ b/core/src/main/java/org/apache/ki/session/mgt/eis/MemorySessionDAO.java
@@ -21,8 +21,8 @@
 import java.io.Serializable;
 import java.util.Random;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.cache.HashtableCacheManager;
 import org.apache.ki.session.Session;
@@ -58,7 +58,7 @@
 
     //TODO - complete JavaDoc
 
-    private static final Log log = LogFactory.getLog(MemorySessionDAO.class);
+    private static final Logger log = LoggerFactory.getLogger(MemorySessionDAO.class);
 
     private static final String RANDOM_NUM_GENERATOR_ALGORITHM_NAME = "SHA1PRNG";
     private Random randomNumberGenerator = null;
diff --git a/core/src/main/java/org/apache/ki/subject/DelegatingSubject.java b/core/src/main/java/org/apache/ki/subject/DelegatingSubject.java
index 94445df..20653c2 100644
--- a/core/src/main/java/org/apache/ki/subject/DelegatingSubject.java
+++ b/core/src/main/java/org/apache/ki/subject/DelegatingSubject.java
@@ -24,8 +24,8 @@
 import java.util.Collection;
 import java.util.List;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authc.AuthenticationException;
 import org.apache.ki.authc.AuthenticationToken;
@@ -70,7 +70,7 @@
 
     //TODO - complete JavaDoc
 
-    private static final Log log = LogFactory.getLog(DelegatingSubject.class);
+    private static final Logger log = LoggerFactory.getLogger(DelegatingSubject.class);
 
     protected PrincipalCollection principals = new SimplePrincipalCollection();
     protected boolean authenticated = false;
diff --git a/core/src/main/java/org/apache/ki/util/ClassUtils.java b/core/src/main/java/org/apache/ki/util/ClassUtils.java
index 3056bfe..65707b8 100644
--- a/core/src/main/java/org/apache/ki/util/ClassUtils.java
+++ b/core/src/main/java/org/apache/ki/util/ClassUtils.java
@@ -21,8 +21,8 @@
 import java.io.InputStream;
 import java.lang.reflect.Constructor;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 
 /**
@@ -37,7 +37,7 @@
     //TODO - complete JavaDoc
 
     /** Private internal log instance. */
-    private static final Log log = LogFactory.getLog(ClassUtils.class);
+    private static final Logger log = LoggerFactory.getLogger(ClassUtils.class);
 
     /**
      * Returns the specified resource by checking the current thread's
diff --git a/core/src/main/java/org/apache/ki/util/JdbcUtils.java b/core/src/main/java/org/apache/ki/util/JdbcUtils.java
index ea02151..84db5fb 100644
--- a/core/src/main/java/org/apache/ki/util/JdbcUtils.java
+++ b/core/src/main/java/org/apache/ki/util/JdbcUtils.java
@@ -23,8 +23,8 @@
 import java.sql.SQLException;

 import java.sql.Statement;

 

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 /**

  * A set of static helper methods for managing JDBC API objects.

@@ -39,7 +39,7 @@
 public class JdbcUtils {

 

     /** Private internal log instance. */

-    private static final Log log = LogFactory.getLog(JdbcUtils.class);

+    private static final Logger log = LoggerFactory.getLogger(JdbcUtils.class);

 

     /**

      * Private constructor to prevent instantiation.

diff --git a/core/src/main/java/org/apache/ki/util/LifecycleUtils.java b/core/src/main/java/org/apache/ki/util/LifecycleUtils.java
index 286391f..142d51b 100644
--- a/core/src/main/java/org/apache/ki/util/LifecycleUtils.java
+++ b/core/src/main/java/org/apache/ki/util/LifecycleUtils.java
@@ -20,8 +20,8 @@
 

 import java.util.Collection;

 

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 import org.apache.ki.KiException;

 

@@ -33,7 +33,7 @@
  */

 public abstract class LifecycleUtils {

 

-    private static final Log log = LogFactory.getLog(LifecycleUtils.class);

+    private static final Logger log = LoggerFactory.getLogger(LifecycleUtils.class);

 

     public static void init(Object o) throws KiException {

         if (o instanceof Initializable) {

diff --git a/core/src/main/java/org/apache/ki/util/ThreadContext.java b/core/src/main/java/org/apache/ki/util/ThreadContext.java
index a88a495..481dafe 100644
--- a/core/src/main/java/org/apache/ki/util/ThreadContext.java
+++ b/core/src/main/java/org/apache/ki/util/ThreadContext.java
@@ -23,8 +23,8 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.mgt.SecurityManager;
 import org.apache.ki.subject.Subject;
@@ -52,7 +52,7 @@
     /**
      * Private internal log instance.
      */
-    private static final Log log = LogFactory.getLog(ThreadContext.class);
+    private static final Logger log = LoggerFactory.getLogger(ThreadContext.class);
 
     public static final String SECURITY_MANAGER_KEY = ThreadContext.class.getName() + "_SECURITY_MANAGER_KEY";
     public static final String SUBJECT_KEY = ThreadContext.class.getName() + "_SUBJECT_KEY";
diff --git a/pom.xml b/pom.xml
index 5a19cf7..9f93559 100644
--- a/pom.xml
+++ b/pom.xml
@@ -64,6 +64,7 @@
 
     <properties>
         <jdk.version>1.5</jdk.version>
+        <slf4j.version>1.5.6</slf4j.version>
         <hsqldbVersion>1.8.0.7</hsqldbVersion>
         <jettyVersion>6.1.14</jettyVersion>
         <kiVersion>1.0-incubating-SNAPSHOT</kiVersion>
@@ -97,6 +98,33 @@
                     <encoding>UTF-8</encoding>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-source-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>attach-sources</id>
+                        <goals>
+                            <goal>jar</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <inherited>true</inherited>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-javadoc-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>attach-api-docs</id>
+                        <goals>
+                            <goal>jar</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <version>2.2</version>
+                <inherited>true</inherited>
+            </plugin>
         </plugins>
     </build>
 
@@ -143,36 +171,34 @@
                 <artifactId>ki-spring</artifactId>
                 <version>${kiVersion}</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.ki</groupId>
+                <artifactId>ki-all</artifactId>
+                <version>${kiVersion}</version>
+            </dependency>
 
             <!-- 3rd party dependencies -->
             <dependency>
+                <groupId>org.slf4j</groupId>
+                <artifactId>slf4j-api</artifactId>
+                <version>${slf4j.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.slf4j</groupId>
+                <artifactId>slf4j-simple</artifactId>
+                <version>${slf4j.version}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.slf4j</groupId>
+                <artifactId>slf4j-log4j12</artifactId>
+                <version>${slf4j.version}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
                 <groupId>commons-beanutils</groupId>
                 <artifactId>commons-beanutils</artifactId>
                 <version>1.7.0</version>
-                <optional>true</optional>
-            </dependency>
-            <dependency>
-                <groupId>commons-logging</groupId>
-                <artifactId>commons-logging</artifactId>
-                <version>1.1.1</version>
-                <exclusions>
-                    <exclusion>
-                        <groupId>log4j</groupId>
-                        <artifactId>log4j</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>logkit</groupId>
-                        <artifactId>logkit</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>avalon-framework</groupId>
-                        <artifactId>avalon-framework</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>javax.servlet</groupId>
-                        <artifactId>servlet-api</artifactId>
-                    </exclusion>
-                </exclusions>
             </dependency>
             <dependency>
                 <groupId>hsqldb</groupId>
@@ -222,6 +248,7 @@
                 <groupId>net.sf.ehcache</groupId>
                 <artifactId>ehcache</artifactId>
                 <version>1.4.1</version>
+                <optional>true</optional>
             </dependency>
             <dependency>
                 <groupId>net.sourceforge.retroweaver</groupId>
@@ -239,21 +266,25 @@
                 <groupId>org.springframework</groupId>
                 <artifactId>spring</artifactId>
                 <version>${springframeworkVersion}</version>
+                <optional>true</optional>
             </dependency>
             <dependency>
                 <groupId>org.springframework</groupId>
                 <artifactId>spring-webmvc</artifactId>
                 <version>${springframeworkVersion}</version>
+                <optional>true</optional>
             </dependency>
             <dependency>
                 <groupId>quartz</groupId>
                 <artifactId>quartz</artifactId>
                 <version>1.5.2</version>
+                <optional>true</optional>
             </dependency>
             <dependency>
                 <groupId>taglibs</groupId>
                 <artifactId>standard</artifactId>
                 <version>1.1.2</version>
+                <scope>test</scope>
             </dependency>
         </dependencies>
     </dependencyManagement>
diff --git a/samples/quickstart/pom.xml b/samples/quickstart/pom.xml
index 1548208..19d7269 100644
--- a/samples/quickstart/pom.xml
+++ b/samples/quickstart/pom.xml
@@ -37,6 +37,11 @@
             <groupId>org.apache.ki</groupId>
             <artifactId>ki-core</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-simple</artifactId>
+            <scope>runtime</scope>
+        </dependency>
 
     </dependencies>
 
diff --git a/samples/quickstart/src/main/java/Quickstart.java b/samples/quickstart/src/main/java/Quickstart.java
index 30eb20f..0423238 100644
--- a/samples/quickstart/src/main/java/Quickstart.java
+++ b/samples/quickstart/src/main/java/Quickstart.java
@@ -17,8 +17,8 @@
  * under the License.
  */
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.apache.ki.SecurityUtils;
 import org.apache.ki.mgt.DefaultSecurityManager;
 import org.apache.ki.session.Session;
@@ -37,7 +37,7 @@
  */
 public class Quickstart {
 
-    private static final transient Log log = LogFactory.getLog(Quickstart.class);
+    private static final transient Logger log = LoggerFactory.getLogger(Quickstart.class);
 
 
     public static void main( String[] args ) {
diff --git a/samples/spring-hibernate/pom.xml b/samples/spring-hibernate/pom.xml
index e860b18..742bac6 100644
--- a/samples/spring-hibernate/pom.xml
+++ b/samples/spring-hibernate/pom.xml
@@ -93,6 +93,10 @@
             <scope>provided</scope>
         </dependency>
         <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-log4j12</artifactId>
+        </dependency>
+        <dependency>
             <groupId>log4j</groupId>
             <artifactId>log4j</artifactId>
         </dependency>
diff --git a/samples/spring/pom.xml b/samples/spring/pom.xml
index 5348d5a..71a1b71 100644
--- a/samples/spring/pom.xml
+++ b/samples/spring/pom.xml
@@ -83,6 +83,10 @@
             <scope>provided</scope>
         </dependency>
         <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-log4j12</artifactId>
+        </dependency>
+        <dependency>
             <groupId>log4j</groupId>
             <artifactId>log4j</artifactId>
         </dependency>
diff --git a/samples/spring/src/main/java/org/apache/ki/samples/spring/BootstrapDataPopulator.java b/samples/spring/src/main/java/org/apache/ki/samples/spring/BootstrapDataPopulator.java
index fbb374f..96785c1 100644
--- a/samples/spring/src/main/java/org/apache/ki/samples/spring/BootstrapDataPopulator.java
+++ b/samples/spring/src/main/java/org/apache/ki/samples/spring/BootstrapDataPopulator.java
@@ -23,8 +23,8 @@
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.jdbc.core.JdbcTemplate;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.crypto.hash.Sha256Hash;
 
@@ -58,7 +58,7 @@
             "    primary key (role_name, permission)\n" +
             ");";
 
-    private static final Log log = LogFactory.getLog(BootstrapDataPopulator.class);
+    private static final Logger log = LoggerFactory.getLogger(BootstrapDataPopulator.class);
 
     protected DataSource dataSource = null;
 
diff --git a/samples/spring/src/main/java/org/apache/ki/samples/spring/DefaultSampleManager.java b/samples/spring/src/main/java/org/apache/ki/samples/spring/DefaultSampleManager.java
index 567b389..bfca355 100644
--- a/samples/spring/src/main/java/org/apache/ki/samples/spring/DefaultSampleManager.java
+++ b/samples/spring/src/main/java/org/apache/ki/samples/spring/DefaultSampleManager.java
@@ -18,8 +18,8 @@
  */

 package org.apache.ki.samples.spring;

 

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 import org.apache.ki.SecurityUtils;

 import org.apache.ki.session.Session;

@@ -46,7 +46,7 @@
     /*--------------------------------------------

     |    I N S T A N C E   V A R I A B L E S    |

     ============================================*/

-    private static final Log log = LogFactory.getLog(DefaultSampleManager.class);

+    private static final Logger log = LoggerFactory.getLogger(DefaultSampleManager.class);

 

     /*--------------------------------------------

     |         C O N S T R U C T O R S           |

diff --git a/samples/web/pom.xml b/samples/web/pom.xml
index 3f1b3cc..9114d3e 100644
--- a/samples/web/pom.xml
+++ b/samples/web/pom.xml
@@ -49,6 +49,10 @@
             <scope>provided</scope>
         </dependency>
         <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-log4j12</artifactId>
+        </dependency>
+        <dependency>
             <groupId>log4j</groupId>
             <artifactId>log4j</artifactId>
         </dependency>
diff --git a/support/ehcache/pom.xml b/support/ehcache/pom.xml
index 4e45069..0ac2f29 100644
--- a/support/ehcache/pom.xml
+++ b/support/ehcache/pom.xml
@@ -40,6 +40,11 @@
             <groupId>net.sf.ehcache</groupId>
             <artifactId>ehcache</artifactId>
         </dependency>
+        <!-- Test dependencies -->
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-simple</artifactId>
+        </dependency>
     </dependencies>
 
 </project>
diff --git a/support/ehcache/src/main/java/org/apache/ki/cache/ehcache/EhCache.java b/support/ehcache/src/main/java/org/apache/ki/cache/ehcache/EhCache.java
index 34c72cb..ba413d5 100644
--- a/support/ehcache/src/main/java/org/apache/ki/cache/ehcache/EhCache.java
+++ b/support/ehcache/src/main/java/org/apache/ki/cache/ehcache/EhCache.java
@@ -25,8 +25,8 @@
 
 import net.sf.ehcache.Element;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.cache.Cache;
 import org.apache.ki.cache.CacheException;
@@ -42,7 +42,7 @@
 public class EhCache implements Cache {
 
     /** Private internal log instance. */
-    private static final Log log = LogFactory.getLog(EhCache.class);
+    private static final Logger log = LoggerFactory.getLogger(EhCache.class);
 
     /**
      * The wrapped Ehcache instance.
diff --git a/support/ehcache/src/main/java/org/apache/ki/cache/ehcache/EhCacheManager.java b/support/ehcache/src/main/java/org/apache/ki/cache/ehcache/EhCacheManager.java
index c2200c3..8606364 100644
--- a/support/ehcache/src/main/java/org/apache/ki/cache/ehcache/EhCacheManager.java
+++ b/support/ehcache/src/main/java/org/apache/ki/cache/ehcache/EhCacheManager.java
@@ -21,8 +21,8 @@
 import java.io.IOException;
 import java.io.InputStream;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.cache.Cache;
 import org.apache.ki.cache.CacheException;
@@ -71,7 +71,7 @@
     /**
      * This class's private log instance.
      */
-    private static final Log log = LogFactory.getLog(EhCacheManager.class);
+    private static final Logger log = LoggerFactory.getLogger(EhCacheManager.class);
 
     /**
      * The EhCache cache manager used by this implementation to create caches.
diff --git a/support/quartz/pom.xml b/support/quartz/pom.xml
index c458107..e38db37 100644
--- a/support/quartz/pom.xml
+++ b/support/quartz/pom.xml
@@ -40,6 +40,11 @@
             <groupId>quartz</groupId>
             <artifactId>quartz</artifactId>
         </dependency>
+        <!-- Test dependencies -->
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-simple</artifactId>
+        </dependency>
     </dependencies>
 
 </project>
diff --git a/support/quartz/src/main/java/org/apache/ki/session/mgt/quartz/QuartzSessionValidationJob.java b/support/quartz/src/main/java/org/apache/ki/session/mgt/quartz/QuartzSessionValidationJob.java
index 869d65e..74f064c 100644
--- a/support/quartz/src/main/java/org/apache/ki/session/mgt/quartz/QuartzSessionValidationJob.java
+++ b/support/quartz/src/main/java/org/apache/ki/session/mgt/quartz/QuartzSessionValidationJob.java
@@ -23,8 +23,8 @@
 import org.quartz.JobExecutionContext;
 import org.quartz.JobExecutionException;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.session.mgt.ValidatingSessionManager;
 
@@ -49,7 +49,7 @@
     /*--------------------------------------------
     |    I N S T A N C E   V A R I A B L E S    |
     ============================================*/
-    private static final Log log = LogFactory.getLog(QuartzSessionValidationJob.class);
+    private static final Logger log = LoggerFactory.getLogger(QuartzSessionValidationJob.class);
 
     /*--------------------------------------------
     |         C O N S T R U C T O R S           |
diff --git a/support/quartz/src/main/java/org/apache/ki/session/mgt/quartz/QuartzSessionValidationScheduler.java b/support/quartz/src/main/java/org/apache/ki/session/mgt/quartz/QuartzSessionValidationScheduler.java
index 7bbd43d..e7afadd 100644
--- a/support/quartz/src/main/java/org/apache/ki/session/mgt/quartz/QuartzSessionValidationScheduler.java
+++ b/support/quartz/src/main/java/org/apache/ki/session/mgt/quartz/QuartzSessionValidationScheduler.java
@@ -24,8 +24,8 @@
 import org.quartz.SimpleTrigger;
 import org.quartz.impl.StdSchedulerFactory;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.session.mgt.DefaultSessionManager;
 import org.apache.ki.session.mgt.SessionValidationScheduler;
@@ -62,7 +62,7 @@
     /*--------------------------------------------
     |    I N S T A N C E   V A R I A B L E S    |
     ============================================*/
-    private static final Log log = LogFactory.getLog(QuartzSessionValidationScheduler.class);
+    private static final Logger log = LoggerFactory.getLogger(QuartzSessionValidationScheduler.class);
 
     /**
      * The configured Quartz scheduler to use to schedule the Quartz job.  If no scheduler is
diff --git a/support/spring/pom.xml b/support/spring/pom.xml
index 888d88f..61069fc 100644
--- a/support/spring/pom.xml
+++ b/support/spring/pom.xml
@@ -49,6 +49,11 @@
             <groupId>org.springframework</groupId>
             <artifactId>spring</artifactId>
         </dependency>
+        <!-- Test dependencies -->
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-simple</artifactId>
+        </dependency>
     </dependencies>
 
 </project>
diff --git a/support/spring/src/main/java/org/apache/ki/spring/LifecycleBeanPostProcessor.java b/support/spring/src/main/java/org/apache/ki/spring/LifecycleBeanPostProcessor.java
index 5e0e80a..e45146d 100644
--- a/support/spring/src/main/java/org/apache/ki/spring/LifecycleBeanPostProcessor.java
+++ b/support/spring/src/main/java/org/apache/ki/spring/LifecycleBeanPostProcessor.java
@@ -22,8 +22,8 @@
 import org.springframework.beans.FatalBeanException;
 import org.springframework.beans.factory.config.DestructionAwareBeanPostProcessor;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.util.Destroyable;
 import org.apache.ki.util.Initializable;
@@ -48,7 +48,7 @@
     /**
      * Private internal class log instance.
      */
-    private static final Log log = LogFactory.getLog(LifecycleBeanPostProcessor.class);
+    private static final Logger log = LoggerFactory.getLogger(LifecycleBeanPostProcessor.class);
 
     /**
      * Calls the <tt>init()</tt> methods on the bean if it implements {@link org.apache.ki.util.Initializable}
diff --git a/support/spring/src/main/java/org/apache/ki/spring/SpringIniWebConfiguration.java b/support/spring/src/main/java/org/apache/ki/spring/SpringIniWebConfiguration.java
index 76952ac..48c94bd 100644
--- a/support/spring/src/main/java/org/apache/ki/spring/SpringIniWebConfiguration.java
+++ b/support/spring/src/main/java/org/apache/ki/spring/SpringIniWebConfiguration.java
@@ -26,8 +26,8 @@
 import org.springframework.context.ApplicationContextException;
 import org.springframework.web.context.support.WebApplicationContextUtils;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.KiException;
 import org.apache.ki.mgt.RealmSecurityManager;
@@ -73,7 +73,7 @@
     public static final String SECURITY_MANAGER_BEAN_NAME_PARAM_NAME = "securityManagerBeanName";
     public static final String DEFAULT_SECURITY_MANAGER_BEAN_ID = "securityManager";
 
-    private static final Log log = LogFactory.getLog(SpringIniWebConfiguration.class);
+    private static final Logger log = LoggerFactory.getLogger(SpringIniWebConfiguration.class);
 
     protected String securityManagerBeanName;
 
diff --git a/support/spring/src/main/java/org/apache/ki/spring/remoting/SecureRemoteInvocationExecutor.java b/support/spring/src/main/java/org/apache/ki/spring/remoting/SecureRemoteInvocationExecutor.java
index 4bca5c0..385cd9f 100644
--- a/support/spring/src/main/java/org/apache/ki/spring/remoting/SecureRemoteInvocationExecutor.java
+++ b/support/spring/src/main/java/org/apache/ki/spring/remoting/SecureRemoteInvocationExecutor.java
@@ -24,8 +24,8 @@
 import org.springframework.remoting.support.DefaultRemoteInvocationExecutor;
 import org.springframework.remoting.support.RemoteInvocation;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.mgt.SecurityManager;
 import org.apache.ki.util.ThreadContext;
@@ -52,7 +52,7 @@
     /*--------------------------------------------
     |    I N S T A N C E   V A R I A B L E S    |
     ============================================*/
-    private static final Log log = LogFactory.getLog(SecureRemoteInvocationExecutor.class);
+    private static final Logger log = LoggerFactory.getLogger(SecureRemoteInvocationExecutor.class);
 
     /**
      * The SecurityManager used to retrieve realms that should be associated with the
diff --git a/support/spring/src/main/java/org/apache/ki/spring/remoting/SecureRemoteInvocationFactory.java b/support/spring/src/main/java/org/apache/ki/spring/remoting/SecureRemoteInvocationFactory.java
index 73f0a02..9b5359a 100644
--- a/support/spring/src/main/java/org/apache/ki/spring/remoting/SecureRemoteInvocationFactory.java
+++ b/support/spring/src/main/java/org/apache/ki/spring/remoting/SecureRemoteInvocationFactory.java
@@ -25,8 +25,8 @@
 import org.springframework.remoting.support.RemoteInvocation;
 import org.springframework.remoting.support.RemoteInvocationFactory;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.SecurityUtils;
 import org.apache.ki.session.Session;
@@ -47,7 +47,7 @@
  */
 public class SecureRemoteInvocationFactory extends DefaultRemoteInvocationFactory {
 
-    private static final Log log = LogFactory.getLog(SecureRemoteInvocationFactory.class);
+    private static final Logger log = LoggerFactory.getLogger(SecureRemoteInvocationFactory.class);
 
     public static final String SESSION_ID_KEY = Session.class.getName() + "_ID_KEY";
 
diff --git a/support/spring/src/main/java/org/apache/ki/spring/security/interceptor/AuthorizationAttributeSourceAdvisor.java b/support/spring/src/main/java/org/apache/ki/spring/security/interceptor/AuthorizationAttributeSourceAdvisor.java
index b45a57e..6ac2289 100644
--- a/support/spring/src/main/java/org/apache/ki/spring/security/interceptor/AuthorizationAttributeSourceAdvisor.java
+++ b/support/spring/src/main/java/org/apache/ki/spring/security/interceptor/AuthorizationAttributeSourceAdvisor.java
@@ -23,8 +23,8 @@
 import org.springframework.aop.support.StaticMethodMatcherPointcutAdvisor;
 import org.springframework.beans.factory.InitializingBean;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authz.annotation.RequiresAuthentication;
 import org.apache.ki.authz.annotation.RequiresGuest;
@@ -42,7 +42,7 @@
 public class AuthorizationAttributeSourceAdvisor extends StaticMethodMatcherPointcutAdvisor
         implements InitializingBean {
 
-    private static final Log log = LogFactory.getLog(AuthorizationAttributeSourceAdvisor.class);
+    private static final Logger log = LoggerFactory.getLogger(AuthorizationAttributeSourceAdvisor.class);
 
     protected SecurityManager securityManager = null;
 
diff --git a/web/pom.xml b/web/pom.xml
index 16ed23e..f8f8158 100644
--- a/web/pom.xml
+++ b/web/pom.xml
@@ -48,6 +48,12 @@
             <groupId>javax.servlet</groupId>
             <artifactId>servlet-api</artifactId>
         </dependency>
+
+        <!-- Test dependencies -->
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-simple</artifactId>
+        </dependency>
     </dependencies>
 
 </project>
diff --git a/web/src/main/java/org/apache/ki/web/DefaultWebSecurityManager.java b/web/src/main/java/org/apache/ki/web/DefaultWebSecurityManager.java
index 8540a29..443fe86 100644
--- a/web/src/main/java/org/apache/ki/web/DefaultWebSecurityManager.java
+++ b/web/src/main/java/org/apache/ki/web/DefaultWebSecurityManager.java
@@ -21,8 +21,8 @@
 import java.util.Collection;

 import javax.servlet.ServletRequest;

 

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 import org.apache.ki.mgt.DefaultSecurityManager;

 import org.apache.ki.realm.Realm;

@@ -46,7 +46,7 @@
 

     //TODO - complete JavaDoc

 

-    private static final Log log = LogFactory.getLog(DefaultWebSecurityManager.class);

+    private static final Logger log = LoggerFactory.getLogger(DefaultWebSecurityManager.class);

 

     public static final String HTTP_SESSION_MODE = "http";

     public static final String KI_SESSION_MODE = "ki";

diff --git a/web/src/main/java/org/apache/ki/web/RedirectView.java b/web/src/main/java/org/apache/ki/web/RedirectView.java
index ed3aed6..2ecc394 100644
--- a/web/src/main/java/org/apache/ki/web/RedirectView.java
+++ b/web/src/main/java/org/apache/ki/web/RedirectView.java
@@ -25,8 +25,8 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.util.JavaEnvironment;
 
@@ -78,7 +78,7 @@
      */
     public static final String DEFAULT_ENCODING_SCHEME = "UTF-8";
 
-    private static final Log log = LogFactory.getLog(RedirectView.class);
+    private static final Logger log = LoggerFactory.getLogger(RedirectView.class);
 
     private String url;
 
diff --git a/web/src/main/java/org/apache/ki/web/WebRememberMeManager.java b/web/src/main/java/org/apache/ki/web/WebRememberMeManager.java
index e93106f..12831fd 100644
--- a/web/src/main/java/org/apache/ki/web/WebRememberMeManager.java
+++ b/web/src/main/java/org/apache/ki/web/WebRememberMeManager.java
@@ -21,8 +21,8 @@
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.codec.Base64;
 import org.apache.ki.mgt.AbstractRememberMeManager;
@@ -61,7 +61,7 @@
 
     //TODO - complete JavaDoc
 
-    private static transient final Log log = LogFactory.getLog(WebRememberMeManager.class);
+    private static transient final Logger log = LoggerFactory.getLogger(WebRememberMeManager.class);
 
     /**
      * The default name of the underlying rememberMe cookie which is <code>rememberMe</code>.
diff --git a/web/src/main/java/org/apache/ki/web/WebSubjectFactory.java b/web/src/main/java/org/apache/ki/web/WebSubjectFactory.java
index 8a35ffd..1b60b44 100644
--- a/web/src/main/java/org/apache/ki/web/WebSubjectFactory.java
+++ b/web/src/main/java/org/apache/ki/web/WebSubjectFactory.java
@@ -49,7 +49,7 @@
         super(securityManager);
     }
 
-    public WebSubjectFactory(org.apache.ki.mgt.SecurityManager securityManager, WebSessionManager webSessionManager) {
+    public WebSubjectFactory(SecurityManager securityManager, WebSessionManager webSessionManager) {
         super(securityManager);
         setWebSessionManager(webSessionManager);
     }
diff --git a/web/src/main/java/org/apache/ki/web/WebUtils.java b/web/src/main/java/org/apache/ki/web/WebUtils.java
index 3ea3a97..f42a6f7 100644
--- a/web/src/main/java/org/apache/ki/web/WebUtils.java
+++ b/web/src/main/java/org/apache/ki/web/WebUtils.java
@@ -29,8 +29,8 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.SecurityUtils;
 import org.apache.ki.session.Session;
@@ -54,7 +54,7 @@
 
     //TODO - complete JavaDoc
 
-    private static final Log log = LogFactory.getLog(WebUtils.class);
+    private static final Logger log = LoggerFactory.getLogger(WebUtils.class);
 
 
     /**
diff --git a/web/src/main/java/org/apache/ki/web/attr/AbstractWebAttribute.java b/web/src/main/java/org/apache/ki/web/attr/AbstractWebAttribute.java
index 40f7cec..a9d9058 100644
--- a/web/src/main/java/org/apache/ki/web/attr/AbstractWebAttribute.java
+++ b/web/src/main/java/org/apache/ki/web/attr/AbstractWebAttribute.java
@@ -22,8 +22,8 @@
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.KiException;
 import org.apache.ki.util.ClassUtils;
@@ -46,7 +46,7 @@
 
     public static final String DEFAULT_NAME = "name";
 
-    private static final Log log = LogFactory.getLog(AbstractWebAttribute.class);
+    private static final Logger log = LoggerFactory.getLogger(AbstractWebAttribute.class);
 
     protected String name = DEFAULT_NAME;
 
diff --git a/web/src/main/java/org/apache/ki/web/attr/CookieAttribute.java b/web/src/main/java/org/apache/ki/web/attr/CookieAttribute.java
index da7c31c..a47b5be 100644
--- a/web/src/main/java/org/apache/ki/web/attr/CookieAttribute.java
+++ b/web/src/main/java/org/apache/ki/web/attr/CookieAttribute.java
@@ -25,8 +25,8 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.util.StringUtils;
 import static org.apache.ki.web.WebUtils.toHttp;
@@ -45,7 +45,7 @@
     /**
      * Private internal log instance.
      */
-    private static final Log log = LogFactory.getLog(CookieAttribute.class);
+    private static final Logger log = LoggerFactory.getLogger(CookieAttribute.class);
 
     /**
      * The number of seconds in one year (= 60 * 60 * 24 * 365).
diff --git a/web/src/main/java/org/apache/ki/web/attr/RequestParamAttribute.java b/web/src/main/java/org/apache/ki/web/attr/RequestParamAttribute.java
index d298c2b..506f191 100644
--- a/web/src/main/java/org/apache/ki/web/attr/RequestParamAttribute.java
+++ b/web/src/main/java/org/apache/ki/web/attr/RequestParamAttribute.java
@@ -21,8 +21,8 @@
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * @author Les Hazlewood
@@ -32,7 +32,7 @@
 
     //TODO - complete JavaDoc
 
-    private static final Log log = LogFactory.getLog(RequestParamAttribute.class);    
+    private static final Logger log = LoggerFactory.getLogger(RequestParamAttribute.class);
 
     public RequestParamAttribute() {
         setMutable(false);
diff --git a/web/src/main/java/org/apache/ki/web/config/IniWebConfiguration.java b/web/src/main/java/org/apache/ki/web/config/IniWebConfiguration.java
index 97ec8bc..3c234a1 100644
--- a/web/src/main/java/org/apache/ki/web/config/IniWebConfiguration.java
+++ b/web/src/main/java/org/apache/ki/web/config/IniWebConfiguration.java
@@ -31,8 +31,8 @@
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.config.ConfigurationException;
 import org.apache.ki.config.IniConfiguration;
@@ -65,7 +65,7 @@
 
     //TODO - complete JavaDoc
 
-    private static final transient Log log = LogFactory.getLog(IniWebConfiguration.class);
+    private static final transient Logger log = LoggerFactory.getLogger(IniWebConfiguration.class);
 
     public static final String FILTERS = "filters";
     public static final String URLS = "urls";
diff --git a/web/src/main/java/org/apache/ki/web/filter/PathMatchingFilter.java b/web/src/main/java/org/apache/ki/web/filter/PathMatchingFilter.java
index 8140db5..28aeaa5 100644
--- a/web/src/main/java/org/apache/ki/web/filter/PathMatchingFilter.java
+++ b/web/src/main/java/org/apache/ki/web/filter/PathMatchingFilter.java
@@ -24,8 +24,8 @@
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.util.AntPathMatcher;
 import org.apache.ki.util.PatternMatcher;
@@ -45,7 +45,7 @@
     /**
      * Log available to this class only
      */
-    private static final Log log = LogFactory.getLog(PathMatchingFilter.class);
+    private static final Logger log = LoggerFactory.getLogger(PathMatchingFilter.class);
 
     /**
      * PatternMatcher used in determining which paths to react to for a given request.
diff --git a/web/src/main/java/org/apache/ki/web/filter/authc/BasicHttpAuthenticationFilter.java b/web/src/main/java/org/apache/ki/web/filter/authc/BasicHttpAuthenticationFilter.java
index 088e268..f6af1ec 100644
--- a/web/src/main/java/org/apache/ki/web/filter/authc/BasicHttpAuthenticationFilter.java
+++ b/web/src/main/java/org/apache/ki/web/filter/authc/BasicHttpAuthenticationFilter.java
@@ -23,8 +23,8 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authc.AuthenticationToken;
 import org.apache.ki.codec.Base64;
@@ -68,7 +68,7 @@
     /**
      * This class's private logger.
      */
-    private static final Log log = LogFactory.getLog(BasicHttpAuthenticationFilter.class);
+    private static final Logger log = LoggerFactory.getLogger(BasicHttpAuthenticationFilter.class);
 
     /**
      * HTTP Authorization header, equal to <code>Authorization</code>
diff --git a/web/src/main/java/org/apache/ki/web/filter/authc/FormAuthenticationFilter.java b/web/src/main/java/org/apache/ki/web/filter/authc/FormAuthenticationFilter.java
index 6951136..e8fbaf7 100644
--- a/web/src/main/java/org/apache/ki/web/filter/authc/FormAuthenticationFilter.java
+++ b/web/src/main/java/org/apache/ki/web/filter/authc/FormAuthenticationFilter.java
@@ -22,8 +22,8 @@
 import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.authc.AuthenticationException;
 import org.apache.ki.authc.AuthenticationToken;
@@ -69,7 +69,7 @@
     public static final String DEFAULT_PASSWORD_PARAM = "password";
     public static final String DEFAULT_REMEMBER_ME_PARAM = "rememberMe";
 
-    private static final Log log = LogFactory.getLog(FormAuthenticationFilter.class);
+    private static final Logger log = LoggerFactory.getLogger(FormAuthenticationFilter.class);
 
     private String usernameParam = DEFAULT_USERNAME_PARAM;
     private String passwordParam = DEFAULT_PASSWORD_PARAM;
diff --git a/web/src/main/java/org/apache/ki/web/servlet/AdviceFilter.java b/web/src/main/java/org/apache/ki/web/servlet/AdviceFilter.java
index 2dc97c0..ea97626 100644
--- a/web/src/main/java/org/apache/ki/web/servlet/AdviceFilter.java
+++ b/web/src/main/java/org/apache/ki/web/servlet/AdviceFilter.java
@@ -24,8 +24,8 @@
 import javax.servlet.ServletRequest;

 import javax.servlet.ServletResponse;

 

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 /**

  * A Servlet Filter that enables AOP-style advice for a SerlvetRequest via

@@ -40,7 +40,7 @@
 public abstract class AdviceFilter extends OncePerRequestFilter {

 

     /** The static logger available to this class only */

-    private static final Log log = LogFactory.getLog(AdviceFilter.class);

+    private static final Logger log = LoggerFactory.getLogger(AdviceFilter.class);

 

     /**

      * Returns <code>true</code> if the filter chain should be allowed to continue, <code>false</code> otherwise.

diff --git a/web/src/main/java/org/apache/ki/web/servlet/KiFilter.java b/web/src/main/java/org/apache/ki/web/servlet/KiFilter.java
index f55725d..cfd7903 100644
--- a/web/src/main/java/org/apache/ki/web/servlet/KiFilter.java
+++ b/web/src/main/java/org/apache/ki/web/servlet/KiFilter.java
@@ -30,8 +30,8 @@
 import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.beanutils.PropertyUtils;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.config.Configuration;
 import org.apache.ki.config.ConfigurationException;
@@ -191,7 +191,7 @@
     public static final String CONFIG_INIT_PARAM_NAME = "config";
     public static final String CONFIG_URL_INIT_PARAM_NAME = "configUrl";
 
-    private static final Log log = LogFactory.getLog(KiFilter.class);
+    private static final Logger log = LoggerFactory.getLogger(KiFilter.class);
 
     protected String config;
     protected String configUrl;
diff --git a/web/src/main/java/org/apache/ki/web/servlet/OncePerRequestFilter.java b/web/src/main/java/org/apache/ki/web/servlet/OncePerRequestFilter.java
index 2f17814..30bdf1b 100644
--- a/web/src/main/java/org/apache/ki/web/servlet/OncePerRequestFilter.java
+++ b/web/src/main/java/org/apache/ki/web/servlet/OncePerRequestFilter.java
@@ -26,8 +26,8 @@
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.util.Nameable;
 
@@ -51,7 +51,7 @@
 public abstract class OncePerRequestFilter extends ServletContextSupport implements Filter, Nameable {
 
     /** Private internal log instance. */
-    private static final Log log = LogFactory.getLog(OncePerRequestFilter.class);
+    private static final Logger log = LoggerFactory.getLogger(OncePerRequestFilter.class);
 
     /**
      * Suffix that gets appended to the filter name for the "already filtered" request attribute.
diff --git a/web/src/main/java/org/apache/ki/web/servlet/ProxiedFilterChain.java b/web/src/main/java/org/apache/ki/web/servlet/ProxiedFilterChain.java
index adb6d8b..a7a7b24 100644
--- a/web/src/main/java/org/apache/ki/web/servlet/ProxiedFilterChain.java
+++ b/web/src/main/java/org/apache/ki/web/servlet/ProxiedFilterChain.java
@@ -26,8 +26,8 @@
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * @author Les Hazlewood
@@ -37,7 +37,7 @@
 
     //TODO - complete JavaDoc
 
-    private static final Log log = LogFactory.getLog(ProxiedFilterChain.class);
+    private static final Logger log = LoggerFactory.getLogger(ProxiedFilterChain.class);
 
     private FilterChain orig;
     private List<Filter> filters;
diff --git a/web/src/main/java/org/apache/ki/web/session/DefaultWebSessionManager.java b/web/src/main/java/org/apache/ki/web/session/DefaultWebSessionManager.java
index 828353e..8d54a3b 100644
--- a/web/src/main/java/org/apache/ki/web/session/DefaultWebSessionManager.java
+++ b/web/src/main/java/org/apache/ki/web/session/DefaultWebSessionManager.java
@@ -18,14 +18,6 @@
  */
 package org.apache.ki.web.session;
 
-import java.io.Serializable;
-import java.net.InetAddress;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
 import org.apache.ki.authz.AuthorizationException;
 import org.apache.ki.authz.HostUnauthorizedException;
 import org.apache.ki.session.InvalidSessionException;
@@ -37,6 +29,13 @@
 import org.apache.ki.web.attr.WebAttribute;
 import org.apache.ki.web.servlet.KiHttpServletRequest;
 import org.apache.ki.web.servlet.KiHttpSession;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import java.io.Serializable;
+import java.net.InetAddress;
 
 
 /**
@@ -49,7 +48,7 @@
 
     //TODO - complete JavaDoc
 
-    private static final Log log = LogFactory.getLog(DefaultWebSessionManager.class);
+    private static final Logger log = LoggerFactory.getLogger(DefaultWebSessionManager.class);
 
     /**
      * Property specifying if, after a session object is acquired from the request, if that session should be
@@ -195,13 +194,22 @@
         }
         //ensure that the id has been set in the idStore, or if it already has, that it is not different than the
         //'real' session value:
-        Serializable existingId = retrieveSessionId(request, response);
+        Serializable existingId = getReferencedSessionId(request, response);
         if (existingId == null || !currentId.equals(existingId)) {
             getSessionIdCookieAttribute().storeValue(currentId, request, response);
         }
     }
 
-    protected Serializable retrieveSessionId(ServletRequest request, ServletResponse response) {
+    private void markSessionIdValid(Serializable sessionId, ServletRequest request) {
+        request.setAttribute(KiHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
+    }
+
+    private void removeSessionIdCookie(ServletRequest request, ServletResponse response) {
+        getSessionIdCookieAttribute().removeValue(request, response);
+    }
+
+
+    protected Serializable getReferencedSessionId(ServletRequest request, ServletResponse response) {
         WebAttribute<Serializable> cookieSessionIdAttribute = getSessionIdCookieAttribute();
         Serializable id = cookieSessionIdAttribute.retrieveValue(request, response);
         if (id != null) {
@@ -214,32 +222,43 @@
                     KiHttpServletRequest.URL_SESSION_ID_SOURCE);
             }
         }
+        if ( id != null ) {
+            request.setAttribute(KiHttpServletRequest.REFERENCED_SESSION_ID, id);
+        }
         return id;
     }
 
-    public Serializable start(InetAddress hostAddress) throws HostUnauthorizedException, IllegalArgumentException {
+    /**
+     * Stores the Session's ID, usually as a Cookie, to associate with future requests.
+     *
+     * @param session the session that was just {@link #createSession created}.
+     */
+    @Override
+    protected void onStart(Session session) {
         ServletRequest request = WebUtils.getRequiredServletRequest();
         ServletResponse response = WebUtils.getRequiredServletResponse();
-        return start(request, response, hostAddress);
+        onStart(session, request, response);
     }
 
-    protected Serializable start(ServletRequest request, ServletResponse response, InetAddress inetAddress) {
-        Serializable sessionId = super.start(inetAddress);
+    protected void onStart(Session session, ServletRequest request, ServletResponse response) {
+        Serializable sessionId = session.getId();
         storeSessionId(sessionId, request, response);
+        onSessionStart(request);
+    }
+
+    protected void onSessionStart(ServletRequest request) {
         request.removeAttribute(KiHttpServletRequest.REFERENCED_SESSION_ID_SOURCE);
         request.setAttribute(KiHttpServletRequest.REFERENCED_SESSION_IS_NEW, Boolean.TRUE);
-        return sessionId;
     }
 
     @Override
     protected Session retrieveSession(Serializable sessionId) throws InvalidSessionException, AuthorizationException {
-        if (sessionId != null) {
-            return super.retrieveSession(sessionId);
-        } else {
+        if (sessionId == null) {
             ServletRequest request = WebUtils.getRequiredServletRequest();
             ServletResponse response = WebUtils.getRequiredServletResponse();
             return getSession(request, response);
         }
+        return retrieveSessionFromDataSource(sessionId);
     }
 
     /**
@@ -249,52 +268,38 @@
      * @param request  incoming servlet request
      * @param response outgoing servlet response
      * @return the Session associated with the incoming request or <tt>null</tt> if one does not exist.
-     * @throws org.apache.ki.session.InvalidSessionException
-     *          if the associated Session has expired prior to invoking this method.
      * @throws org.apache.ki.authz.AuthorizationException
      *          if the caller is not authorized to access the session associated with the request.
      */
-    public final Session getSession(ServletRequest request, ServletResponse response)
+    public Session getSession(ServletRequest request, ServletResponse response)
         throws InvalidSessionException, AuthorizationException {
 
-        Session session;
-        try {
-            session = doGetSession(request, response);
-        } catch (InvalidSessionException ise) {
-            if (log.isTraceEnabled()) {
-                log.trace("Request Session with id [" + ise.getSessionId() + "] is invalid, message: [" +
-                    ise.getMessage() + "].  Removing any associated session cookie...");
-            }
-            getSessionIdCookieAttribute().removeValue(request, response);
-
-            //give subclass a chance to do something additional if necessary.  Otherwise returning null is just fine:
-            session = handleInvalidSession(request, response, ise);
-        }
-
-        return session;
-    }
-
-    protected Session doGetSession(ServletRequest request, ServletResponse response) {
-
         Session session = null;
-        Serializable sessionId = retrieveSessionId(request, response);
+        Serializable sessionId = getReferencedSessionId(request, response);
 
         if (sessionId != null) {
             request.setAttribute(KiHttpServletRequest.REFERENCED_SESSION_ID, sessionId);
-            session = super.retrieveSession(sessionId);
+            try {
+                session = retrieveSessionFromDataSource(sessionId);
+                markSessionIdValid(sessionId, request);
+            } catch (InvalidSessionException ise) {
+                if (log.isTraceEnabled()) {
+                    log.trace("Request Session with id [" + ise.getSessionId() + "] is invalid, message: [" +
+                        ise.getMessage() + "].  Removing any associated session cookie...");
+                }
+                removeSessionIdCookie(request, response);
+                //give subclass a chance to do something additional if necessary.  Otherwise returning null is just fine:
+                session = handleInvalidSession(request, response, ise);
+            }
             if (isValidateRequestOrigin()) {
                 if (log.isDebugEnabled()) {
                     log.debug("Validating request origin against session origin");
                 }
                 validateSessionOrigin(request, session);
             }
-            if (session != null) {
-                request.setAttribute(KiHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
-            }
         } else {
             if (log.isTraceEnabled()) {
-                log.trace("No Ki session id associated with the given " +
-                    "HttpServletRequest.  A Session will not be returned.");
+                log.trace("A valid Ki session id was not associated with the current request.");
             }
         }
 
@@ -314,6 +319,7 @@
         super.onStop(session);
         ServletRequest request = WebUtils.getRequiredServletRequest();
         ServletResponse response = WebUtils.getRequiredServletResponse();
+        removeSessionIdCookie(request,response);
         getSessionIdCookieAttribute().removeValue(request, response);
     }
 }
diff --git a/web/src/main/java/org/apache/ki/web/tags/AuthenticatedTag.java b/web/src/main/java/org/apache/ki/web/tags/AuthenticatedTag.java
index 5749f5f..c54c961 100644
--- a/web/src/main/java/org/apache/ki/web/tags/AuthenticatedTag.java
+++ b/web/src/main/java/org/apache/ki/web/tags/AuthenticatedTag.java
@@ -21,8 +21,8 @@
 import javax.servlet.jsp.JspException;

 import javax.servlet.jsp.tagext.TagSupport;

 

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 

 /**

@@ -44,7 +44,7 @@
 

     //TODO - complete JavaDoc

 

-    private static final Log log = LogFactory.getLog(AuthenticatedTag.class);

+    private static final Logger log = LoggerFactory.getLogger(AuthenticatedTag.class);

 

     public int onDoStartTag() throws JspException {

         if (getSubject() != null && getSubject().isAuthenticated()) {

diff --git a/web/src/main/java/org/apache/ki/web/tags/GuestTag.java b/web/src/main/java/org/apache/ki/web/tags/GuestTag.java
index af7889e..c0061c1 100644
--- a/web/src/main/java/org/apache/ki/web/tags/GuestTag.java
+++ b/web/src/main/java/org/apache/ki/web/tags/GuestTag.java
@@ -21,8 +21,8 @@
 import javax.servlet.jsp.JspException;
 import javax.servlet.jsp.tagext.TagSupport;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 
 /**
@@ -39,7 +39,7 @@
 
     //TODO - complete JavaDoc
 
-    private static final Log log = LogFactory.getLog(GuestTag.class);    
+    private static final Logger log = LoggerFactory.getLogger(GuestTag.class);
 
     public int onDoStartTag() throws JspException {
         if (getSubject() == null || getSubject().getPrincipal() == null) {
diff --git a/web/src/main/java/org/apache/ki/web/tags/NotAuthenticatedTag.java b/web/src/main/java/org/apache/ki/web/tags/NotAuthenticatedTag.java
index 4637e7f..984726d 100644
--- a/web/src/main/java/org/apache/ki/web/tags/NotAuthenticatedTag.java
+++ b/web/src/main/java/org/apache/ki/web/tags/NotAuthenticatedTag.java
@@ -21,8 +21,8 @@
 import javax.servlet.jsp.JspException;

 import javax.servlet.jsp.tagext.TagSupport;

 

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 

 /**

@@ -38,7 +38,7 @@
 

     //TODO - complete JavaDoc

 

-    private static final Log log = LogFactory.getLog(NotAuthenticatedTag.class);    

+    private static final Logger log = LoggerFactory.getLogger(NotAuthenticatedTag.class);

 

     public int onDoStartTag() throws JspException {

         if (getSubject() == null || !getSubject().isAuthenticated()) {

diff --git a/web/src/main/java/org/apache/ki/web/tags/PrincipalTag.java b/web/src/main/java/org/apache/ki/web/tags/PrincipalTag.java
index 4043129..e220ddd 100644
--- a/web/src/main/java/org/apache/ki/web/tags/PrincipalTag.java
+++ b/web/src/main/java/org/apache/ki/web/tags/PrincipalTag.java
@@ -25,8 +25,8 @@
 import javax.servlet.jsp.JspException;

 import javax.servlet.jsp.JspTagException;

 

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

 

 /**

  * <p>Tag used to print out the String value of a user's default principal,

@@ -54,7 +54,7 @@
     /*--------------------------------------------

     |    I N S T A N C E   V A R I A B L E S    |

     ============================================*/

-    private static final Log log = LogFactory.getLog(PrincipalTag.class);

+    private static final Logger log = LoggerFactory.getLogger(PrincipalTag.class);

 

     /**

      * The type of principal to be retrieved, or null if the default principal should be used.

diff --git a/web/src/main/java/org/apache/ki/web/tags/SecureTag.java b/web/src/main/java/org/apache/ki/web/tags/SecureTag.java
index a95437e..9765f1a 100644
--- a/web/src/main/java/org/apache/ki/web/tags/SecureTag.java
+++ b/web/src/main/java/org/apache/ki/web/tags/SecureTag.java
@@ -21,8 +21,8 @@
 import javax.servlet.jsp.JspException;
 import javax.servlet.jsp.tagext.TagSupport;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import org.apache.ki.SecurityUtils;
 import org.apache.ki.subject.Subject;
@@ -35,7 +35,7 @@
 
     //TODO - complete JavaDoc
 
-    private static final Log log = LogFactory.getLog(SecureTag.class);
+    private static final Logger log = LoggerFactory.getLogger(SecureTag.class);
 
     public SecureTag() {
     }
diff --git a/web/src/main/java/org/apache/ki/web/tags/UserTag.java b/web/src/main/java/org/apache/ki/web/tags/UserTag.java
index c7399fd..8b025d2 100644
--- a/web/src/main/java/org/apache/ki/web/tags/UserTag.java
+++ b/web/src/main/java/org/apache/ki/web/tags/UserTag.java
@@ -20,8 +20,8 @@
 
 import javax.servlet.jsp.JspException;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 
 /**
@@ -43,7 +43,7 @@
 
     //TODO - complete JavaDoc
 
-    private static final Log log = LogFactory.getLog(UserTag.class);    
+    private static final Logger log = LoggerFactory.getLogger(UserTag.class);
 
     public int onDoStartTag() throws JspException {
         if (getSubject() != null && getSubject().getPrincipal() != null) {