Using Servlet API 3 and forcing cookie based session ids