you should add `server.getSessionRegistry().remove(session)` here