fix for JSESSIONID should be assigned after a user has been successfully authenticated  TRUNK-3938

When user successfully authenticated, with the fix, it will create a new session from old session with new session id.
Mhh, previously, I have done exact same thing, but it lead to always redirect to login page everytime with valid credentials. I did some search on it. At a successful login at attempt, the attributes needs to copy from the old session to preserve session flow. Otherwise it always ask to login again. THere are many places it specified that like http://www.koelnerwasser.de/?p=11.