fix for JSESSIONID should be assigned after a user has been successfully authenticated  TRUNK-3938

When user successfully authenticated, with the fix, it will create a new session from old session with new session id.
I don't think it is necessary to transfer things from one session object to another, why not just invalidate the olde one and stop there