Previously, if a user had a reference to an existing HttpSession and changed the session id, it would not work. For example: HttpSession s = request.getSession(); request.changeSessionId(); s.setAttribute(...); This commit fixes holding on to a reference of an HttpSession when the session id is changed. Fixes gh-227