Search before asking
Documentation Related
See https://lists.apache.org/thread/01bmlsns7rkf2z1wp7cphl0j6o6q0zww for details/discussion.
Basically, shiro EE integration forces a SessionTrackingMode of COOKIE, regardless of the configuration in web.xml, which is not documented anywhere. This should at least be documented.
Are you willing to submit PR?