I've attached a JMeter Plan which I'm using to test this issue.

In order to get better results, I've also changed the quickstart to avoid issuing a new token for users every time they authenticate. That specific change is not related with this issue, but just an improvement.

If you want, you can also try running your tests using 2.7.0-SNAPSHOT version, which is available on JBoss Nexus. That would be nice to make sure you will not have any issue with Final.