title: strange behaviour spring security session concurrency
body: <p>i find that spring security, session concurrency is very strange.</p>
  
  <pre><code>&lt;sec:session-management&gt;
          &lt;sec:concurrency-control max-sessions="1" error-if-maximum-exceeded="true" /&gt;
  &lt;/sec:session-management&gt;
  </code></pre>
  
  <p>the code means that, just only one user can log in in time.</p>
  
  <ol>
  <li>i successfully login, than hit logout button. log out is successfully (i don't get my username anymore). but when i try to relogin, i just get exception that maximum session exceeded. is session in spring security is not deleted clearly?</li>
  <li>i finish login. and i with out log out, i try to login again. i still can login. but when the second time i to relogin, i get exception that maximum session exceeded. i think it should be rejected to login when first time try to relogin.</li>
  </ol>
  
  <p>thanks for your response
  Best regards</p>