The "Page expired" problem is caused by the render strategy of the framework. By default Wicket uses a redirect-after-post strategy for rendering a page. So if the session is invalidated somewhere in the Page, the following get-request will always show the "Page Expired" message because the session no longer exists.
The simple solution is to change the render strategy in the Application init method:
@Override
protected void init() {
super.init();
getRequestCycleSettings().setRenderStrategy(RenderStrategy.ONE_PASS_RENDER);
}
The downside of this solution is that it suffers from the 'double submit problem' when users press the refresh button on their browser.