My main reservation with Spring is the heavy dependence on runtime reflection. I'd like to see a Java web framework designed for conventional server-rendered web applications (as opposed to API backends), with authentication, CSRF protection, form validation, and so forth, but without heavy use of runtime reflection for wiring up objects.
Edit: Also, especially given that Project Loom is on its way, I think a blocking API like Ninja or Spring MVC is best.