title: session.invalidate() doesn't actually clears JSF session scoped values
body: <p>I am seeing a similar issue as mentioned in this question - <a href="https://stackoverflow.com/questions/1495390/how-do-i-invalidate-a-session-in-jsf">https://stackoverflow.com/questions/1495390/how-do-i-invalidate-a-session-in-jsf</a>.</p>
  
  <p>I have a session scoped LoginBean, which have an action logout as #</p>
  
  <pre><code>    ExternalContext ec = FacesContext.getCurrentInstance().getExternalContext();
      HttpSession session = (HttpSession) ec.getSession(false);
      HttpServletResponse response = (HttpServletResponse) ec.getResponse();
  
      // remove cookies
      response.addCookie(facade.removeCookie(((HttpServletRequest)ec.getRequest()).getCookies()));
      // check what we have in sessionMap
      System.out.println(ec.getSessionMap());
      // remove attribute
      session.removeAttribute("XYZ");
  
      // invalidate session
      if (session != null) {
          System.out.println("invalidating session");
          session.invalidate();
      }
      // see what is there in session map
      System.out.println(ec.getSessionMap());
  </code></pre>
  
  <p>It almost work fine.</p>
  
  <p>Output # </p>
  
  <p><code>{xyzBean=com.xyz.bean.XYZBean@46f046f0,... }</code><br>
  <code>invalidating session</code><br>
  <code>{}</code>  </p>
  
  <p>The sessionMap being empty, means there are no session scope beans. However, after logout action it redirects to another same page. Login being a layer on same page. I see that fragment jsps still have showing old data.</p>
  
  <p>I am not removing JSESSIONID in facade.removeCookie. It removes some other cookies related to user.</p>
  
  <p>Any help would be appreciated. </p>
  
  <p>Thanks.</p>