In the access logs you see 302 http codes with _afrLoop parameters (302 - redirect).
Really could not figure this one out. I added failover and clustering removed them. Reconfigured the security. Created a test app with one page used weblogics default security provider but still NOTHING. I even setup a cluster on my machine and everything worked (Note: I did not setup our dev cluster)
So in desperation I check the system-jazn-data.xml file deployed on weblogic an lo and behold none of my application security configurations where setup in the file. I stopped everything and added what I had on my local cluster to the system-jazn-data.xml and everything just works. I need to find out what in our dev configuration is causing the system-jazn-data.xml file not to be updated and will post here when found.
Hope this save someone some time becuase it wasted a LOT of my time.
Final Word: Always a good idea to read the documentation:
Under the heading 7.3.1 Deploying to a Test Environment
Other ConsiderationsWhen deploying an application to multiple managed servers, be sure to include the administration server so that data is migrated as expected.
This fixed it for me.