Minor Description
Wicket JavaScript has a default precondition, that prevents Ajax requests from being fired, should the component no longer be on the page.
If a component is not visible, but nevertheless is writing a placeholder tag, the request is still fired. This results in a ListenerInvocationNotAllowedException and redirect to an access denied page.
Wicket could add some magic to prevent this from happening.