If no user profile is returned, nothing is erased in session: if a previous user profile existed, it's kept. It's for consistency with other frameworks: Spring Security, Shiro, J2E in which it works that way.

Take a look at: https://github.com/leleuj/j2e-pac4j-demo to compare both demos...