NIce. Some ideas from me:
* Identity what sucks and fix it. Reducing and simplyfing steps to secure an application or service.
* Automatic/dynamic client registration built-in to WF subsystem, or maybe to adapter in general
* Ability to force token validation on server-side in services using token introspection endpoint
* Way to specify what URLs are RESTful services and what are web app when both are combined in same WAR (first should return 401, second should redirect to login page)
* Role mapping - ability to map realm and client roles onto different JEE roles
* Remove the need to specify security domain in EJBs
By the way Go ain't Java? So is that not out of scope for JavaOne? Just curious.