Session id is not regenerated upon setting a new user principal