What steps will reproduce the problem? 1. Login as an admin with remember me enabled 2. Logout from admin 3. In the same browser, login as another user with no admin privileges 4. The user has full admin privileges

What is the expected output? What do you see instead? After logout the user privileges should be cleared and when the new user logs in the correct privileges should be set.

Please use labels and text to provide additional information.

The problem was occuring because the logoff form was submitting to "j_spring_security_exit_user" (formally j_acegi_exit_user) which is part of the switch user functionality instead of calling "j_spring_security_logout" (formally j_acegi_logout). Stupid mistake to make.