I edited JBOSS_HOME/server/all/deploy/jbossweb.sar/context.xml to be the following, but session id cookie values are still only 24 characters in length:
<Context cookies="true" crossContext="true">
<Manager pathname="" sessionIdLength="40"/>
<InstanceListener>org.jboss.web.tomcat.security.RunAsListener</InstanceListener>
</Context>