basic HttpSession eviction (same model as AsyncContext so clearly enhanceable) + ensuring session scope is set when destroying it + invalidating sessions used by cdi when destroying the app