This is very insightful. Never noticed.you can change the state of an object in an array or Iterable using any of the object's public interface.
Indeed Campbell. It is sinful to expose variables like this. Didn't pay attention.(Actually your example shows poor design; it would be better to say Dog.setName("Fido")
What you have done in not recommended, instead of replacing the complete bean reference you should retrieve the instance from Spring & then set the property.
Yes, the browser caches the form submission values as well as the URL.
when you are refreshing you are effectively sending the same information which you would have previously sent from the login form.
I did a small prototype ,clicking on browser's back or forth button did not trigger any request at all.
And about your question on expired pages: browser wont query the server when you hit the back button until you explicitly click on refresh. If its too much required to refresh the page automatically when you hit the back button..