Thanks Paul!
Just adding <sso cache-container="web"/>
works for me!!
After further review, I don't think we need maxEmptyLife anymore (i.e. as of Wildfly 8.0.0.Alpha2). The original purpose of this was to prevent shutdown of a node from destroying all SSO credentials that might still be valid on other nodes - however, this is no longer the case.