Steps to Reproduce

configure an application wide org.zkoss.web.preferred.locale as library property or servlet context attribute e.g. de_DE

open any zk page
clear the session cookie
initiate au-request to trigger a session timeout message
(clicking this button is sufficient)

<button onClick=""/>

Current Result

the time out message is presented in the locale given in the request header based on your browser's language settings

Expected Result

timeout message displayed in German

Root Cause

If there's no current session, application wide locale preferences are ignored, even if they are available
https://github.com/zkoss/zk/blob/v8.5.1.1/zweb/src/org/zkoss/web/servlet/Charsets.java#L193-L215
e.g. the lines below still return the configured locale even if no session is available

request.getServletContext().getAttribute(Attributes.PREFERRED_LOCALE)
Library.getProperty(Attributes.PREFERRED_LOCALE)