title: Invalidate spring security session
body: <p>i need to invalidate ( or kick ) user session. the application only limit user login only one user per container.</p>
  
  <p>i try to call removeSessionInformation from session registry,  its done to unlock the user. so the other user can login with the kicked session user name.</p>
  
  <p>but SessionContextHolder at that user that been kicked is still. so they still have the same authority to access the protected page.</p>
  
  <p>how to invalidate or remove Principal of SessionContextHolder from specified session registry information?</p>
  
  <p>ps : in my old application, i give one variable in UserDomain (UserDetails) that hold HttpSession. and when they need to kick the user, i just invalidate HttpSession from specified UserDomain. the  but i don't know how to do it in spring (its more likey to remove Principal of SessionContextHolder than HttpSession). implementation is almost the same with how SessionRegistryImpl do in spring.</p>