At least with the Wildfly adapter, clicking cancel gets you a HTTP 400 -- Bad Request on your protected resource, and doing something more graceful would take some thinking.

It's not clear to me what *should* happen when clicking cancel. Users in a browser have a back button, or a button to close the tab, and they can always use that to get out of the login screen.

Maybe the cancel button should just be removed?

Alarik