How can I prevent spring-security from appending ;jsessionid=XXX to login redirects?

In Spring Security 3.0.0 M1 or newer you could set disable-url-rewriting="true" in the <http> namespace. See if that helps. Also see this feature request.