LDEV-2449 invalidate session when user has lost their cookie, so we don't accidentally access a page without knowing the right session id/cookie value (for some reason jboss gets confused and returns a 'Session already invalidated' error in an exception)