I turned asserts on for development purposes and I receive AssertionError from VaadinSession, apparently the lock for VaadinSession is not held - this could possibly lead to race conditions as well. Do you have any tips how to overcome this issue so I can test asserts in my application?
It seems that we use bad assumptions about state of VaadinSession and we certainly have to rework this mechanism of setting current SecurityContext based on VaadinSession attribute. I am going to investigate options for this fix next week.