Its only partially done, but works for SSO/bearer tokens. Should work for CORS but haven't tested yet. Also still need to implemente sign-off too. I'll finish it up once Undertow beta23 is released and integrated with Wildfly master. -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com