Hello,
IMHO, auto-login with remember-me cookie should take place in your first request, i.e. the HTTP one. It should work whatever transport mechanism in use.
As a side note, Shiro seems to be “natively” supported by atmosphere through
ShiroInterceptor
, it creates a request attribute that contains your Shiro subject…