This may be fixed by the 1.34 beta: one of the fixes is to make the disable SecureSpot switch actually work.
Edit: The logic behind this comment is that if the enable/disable SecureSpot used to fix the non-persistent port forwarding in 1.33NA, perhaps the same fix in 1.34beta02/03 will cure the non-persistent virtual server...