I have updated issue #559 (Synchronizing token / CSRF issue;
https://javaserverfaces-spec-public.dev.java.net/issues/show_bug.cgi?id=559) with some sample code for these two issues, and also referenced Dan's work with Seam. I think between these two solutions we can come up with something that works well with JSF 2.1. If you're interested in these issues or the back-button issue (which I'm not as familiar with), please add your comments to this issue we can get this hashed out ASAP.