max-active-sessions doesn't work with enabled statistics

Deploy application which creates sessions on request Define max-active-sessions to N and enable statistics Do N+1 requests (each as new client => something like this for N=3 {{for i in {1..4} ; do curl -I -c cookie$i.txt http://localhost:8080/simple-servlet/counter ; done}} The N + 1 request should be rejected due limit being reached Note when the statistics are not enabled, it works as expected.