Analysis of the initial update shows it to be due to the DOM update propagating up to the entire form. This is due to initial URL-rewriting prior to JSESSIONID cookie establishment:

<form action="/auction/auction.jsf;jsessionid=F4A4B758C8687B8F6486A4993F8CF058" enctype="application/x-www-form-urlencoded" id="iceForm" method="post" name="iceForm">

changes to

<form action="/auction/auction.jsf" enctype="application/x-www-form-urlencoded" id="iceForm" method="post" name="iceForm">

The easiest way to resolve this is likely to establish the session on the first request. We currently redirect from index.html:

<meta http-equiv="Refresh" content="0;url=auction.jsf">

but redirection from index.jsp should be investigated.

There may be cases where a Servlet-mapped welcome page are supported (such as Servlet 3.0), however this would still suffer from the JSESSIONID establishment problem and would subject a critical feature (loading the first page of the application) to a Servlet 3.0 requirement.

<welcome-file-list>
<welcome-file>auction.jsf</welcome-file>
</welcome-file-list>

Using index.jsp as follows is effective at establishing a session prior to JSF rendering:

<%
response.sendRedirect("auction.jsf");
%>

Sample application template also modified. Extra index.html files removed.