I came across several misuses of String.getBytes(). XML streams need to be encoded as indicated by the XML prolog or default to UTF-8 in its absence. Properties streams have to use ISO-8859-1.
The patches don't address the use of platform encoding when creating Base64 digests from the user's credentials for basic auth (btw, this code exists in three locations (jboss, jetty, tomcat), maybe refactor to shared util method?). No idea whether the WWW world eventually agreed on a specific encoding scheme for this case.