Sakai JSF tools do not consistently store STATE on client or server. We should modify all tools to consistently store STATE on client.
The property for web.xml: javax.faces.STATE_SAVING_METHOD
Here is info from documentation:
Define the state method to be used. There are two different options defined by the specification: "client" and "server" state.
When "client" state is configured, all state information required to create the tree is embedded within the data rendered to the client. Note that because data received from a remote client must always be treated as "tainted", care must be taken when using such data. Some StateManager implementations may use encryption to ensure that clients cannot modify the data, and that the data received on postback is therefore trustworthy.
When "server" state is configured, the data is saved somewhere "on the back end", and (at most) a token is embedded in the data rendered to the user.