fix for JSESSIONID should be assigned after a user has been successfully authenticated  TRUNK-3938