After I restarted Tomcat, I found out the authentication is still there, like I have logged in again. However, after I used clean tomcat work directory, the authentication is lost(switched back to anonymousUser).
So how does Spring Security remember the authentication between tomcat shutdowns?
What is in the work directory that is related to authentication that was removed?
Is it related to remember-me functionality?