Preventing session fixation attacks with Spring Security