crossDomainSessionSecurity

Sorry about the delayed reply!
Apart from probably needing to update Spring if you are using it in your project, the DWR 3.0.0 release notes (see http://dwr.2114559.n2.nabble.com/Announcing-the-official-release-of-DWR-3-0-0-td7581090.html) should be a good indication of what you need to look at:

DWR 3.0 RELEASE NOTES (issues resolved since 3.0 RC3) 
===================================================== 

Potentially Breaking Changes 
---------------------------- 

[DWR-645] - Clean up path configuration options 
[DWR-642] - Remove legacy packages 
[DWR-639] - Simplify destroy event methods 
[DWR-511] - Evaluate ServerLoadMonitors, remove unneeded 
            monitors, solidify monitors we want to keep 

Security fixes 
-------------- 

[DWR-638] - Improve DWRSESSIONID cryptographic strength 
[DWR-632] - Improve CSRF protection to handle more scenarios 

New Features and Improvements 
----------------------------- 

[DWR-648] - Add support for Cache-Control and Expires header 
            handling 
[DWR-647] - Allow customization of DWRSESSIONID cookie 
[DWR-644] - Provide a standard way to specify client-side options 
            before DWR loads (dwrConfig) 
[DWR-643] - Allow remapping of DWR's effective contextPath (for 
            DWRSESSIONID cookie etc) 
[DWR-641] - Offer more access to servlet request from Reverse Ajax 
[DWR-636] - Rename allowGetForSafariButMakeForgeryEasier setting 
[DWR-628] - Add support for Spring Java configurations 
[DWR-587] - add support to > ("Content-Disposition", "inline; 
            filename=") 
[DWR-547] - Update class-mapping documentation to mention 
            automatically generated inheritance scripts 
[DWR-110] - add name (javascript) attribute to DataTransferObject 
            annotation 

Bugfixes 
-------- 

[DWR-649] - Optimizing proxies are removing meta-data in DWR 
            responses 
[DWR-646] - Incoming request attributes should be available to 
            ScriptSessionListener.sessionCreated() 
[DWR-640] - Reverse Ajax polling mode broken 
[DWR-635] - New callbackArg option causing conflict when delegating 
            functions 
[DWR-634] - Auto-filled servlet objects (request, session, etc) in 
            method parameters not matched correctly 
[DWR-631] - FileStoreDownloadManager - encodeFileNameSegment 
[DWR-629] - DefaultCreatorManager throws NullPointerException 
            during destroy of Spring context 
[DWR-627] - IllegalStateException on Jetty 8 and 9 
[DWR-614] - org.springframework.util.ClassUtils.forName(className) 
            has been removed in Spring 4.x 
[DWR-585] - java.io.NotSerializableException: 
            org.directwebremoting.impl.DefaultContainer 
[DWR-554] - Reverse ajax client side timeout is missing 
[DWR-396] - Transfering a file using DWR 3.0 disables the "input" 
            events 
[DWR-378] - Window.dwr access permission denied 
[DWR-352] - Javascript error in engine.js when file input field 
            has no parentNode