HttpServletRequest.getSession(...) should return null (or new session) if session attached to exchange is invalid

Currently, HttpServletRequest.getSession(...) will return an invalid session if a concurrent request has invalidated the session. According to the servlet spec, this method should return null (or a new session) if the session currently associated with the request was invalidated.