We think we just stumbled onto the issue. We CANNOT recreate it going DIRECTLY to the Tomcat port on the application server, it only fails going through the web server so we are pretty confident we need to tweak the web server configuration.