Looks like the order does not make a difference (?), and that it is the re-written URL that HibernateFilter sees regardless of order, and that I *don’t* want REQUEST dispatcher enabled in the Hibernate filter – only FORWARD (well, unless I have some non-pretty URLs or other resources that need an open Hibernate session).
I couldn’t figure out why after the first request (which is intercepted by PrettyFaces and results in loadAction) I get a bunch more (seemingly async, bypassing PrettyFilter, but intercepted by HibernateFilter). I’m still not sure what in JSF2/PrimeFaces lifecycle causes it, but without REQUEST dispatcher enabled on HibernateFilter, it is called just once per page load (ignoring AJAX requests, that is), after PrettyFilter forwards the request to the filter chain.
Do you play Magic?
Get TopDecked MTG, the #1 Magic App, built by players, for players. Free to use, forever.