31338a7bdb
This fixes two issues introduced by SEC-1229 * SessionRegistry.registerNewSession is invoked twice * SessionRegistry.removeSession is invoked twice (once by the ConcurrentSessionControlStrategy#onSessionChange and once by SessionRegistryImpl#onApplicationEvent). This is not nearly as problematic since the interface states that implementations should be handle removing the session twice. However, as removing twice requires an unnecessary database hit we should only remove sessions once.