Same sessionid after invalidating session