I have a JSF page which is not protected by `j_security_check`. I perform the following steps:

1. Open the JSF page in a browser.
2. Restart the server.
3. Click a command button on the JSF page to initiate an ajax call.

Firebug shows that a `ViewExpiredException` is raised, as expected. 

> 
> Post:
> 
> 
> 
> ```
> javax.faces.ViewState=8887124636062606698:-1513851009188353364
> 
> ```
> 
> Response:
> 
> 
> 
> ```
> <partial-response>
> <error>
> <error-name>class javax.faces.application.ViewExpiredException</error-name>
> <error-message>viewId:/viewer.xhtml - View /viewer.xhtml could not be restored.</error-message>
> </error>
> </partial-response>
> 
> ```
> 
> 

However, once I configure the page to be protected by `j_security_check` and perform the same steps listed above, strangely (to me) the `ViewExpiredException` is no longer raised. Instead, the reponse is just a new view state. 

> 
> Post:
> 
> 
> 
> ```
> javax.faces.ViewState=-4873187770744721574:8069938124611303615
> 
> ```
> 
> Response:
> 
> 
> 
> ```
> <partial-response>
> <changes>
> <update id="javax.faces.ViewState">234065619769382809:-4498953143834600826</update>
> </changes>
> </partial-response>
> 
> ```
> 
> 

Can someone help me figure this out? I expect it to raise an exception so I can process that exception and show an error page. Now it just responds with a new ViewState, my page just got stuck without any visual feedback.