Well. Problem I seized might be a dead-end. I could reproduce the issues (User closes all the browser windows and then start the browser again. Then he can reach the app without be forced to log in.) only on my own box using jetty. At our testing environment (using tomcat 7) nor at our client we were unable to reproduce this problem.
So my final conclusion that is works out of the box.