There were are few issues with the getLocales() method in the LocaleRequestWrapper class attached in the patch.
1. It simply adds the users preferred locale to list of locales passed by the browser and this could result in duplicate locales being added to the Enumeration returned by this method.
2. The significant bug was that the getLocales() method created an enumeration (in a non threadsafe way) and cached it. Subsequent calls to getLocales() returned the cached Enumerator. The problem with returning a cached Enumerator is that after the caller iterates over the Enumeration, its position remains at where the enumeration last stopped. This simple use case illustrates the problem :
Set the browser language to have the language preferences in the following order zh (chinese), fr, en. Login in and you'll see the content in chinese. Hit the refresh page and you'll notice that some text has been rendered in french. This is because the position of the cached Enumeration has scrolled past the first entry of zh and the web container goes over the remaining values of languages supported by the browser and looks up the french resource bundle.
Fixed the issue by not caching the Enumerator returned by getLocales()