title: Tomcat session cookie doesn't expire
body: <p>I have a web application in Tomcat 7 which keeps user information in session as a DTO object. I also have Spring security enabled for my project which automatically redirects a user to a login page if the user does not have a session.</p>
  
  <p>If I log in to my application once and then I restart Tomcat in Eclipse what happens is that my session gets flushed out but the cookie does not go. </p>
  
  <p>What this means is that after server restart there is no UserDto in session but a valid JSESSIONID remains with browser. Thus spring security still thinks that the user is logged in when in fact he's not.</p>
  
  <p>Why is this happening? (I have check the type of JSESSIONID cookie by viewing page info in Firefox it says - <code>Expire: At end of session</code>. Thus it should ideally expire at server restart or shouldn't it?)</p>
  
  <p>Edit: Though Firefox says <code>Expire: At end of session</code> the cookie is still there if I close and restart Firefox.</p>