Thank you.
I guess I do something similar, like invalidating the session when the user logs off the system. But I wonder if this is just an issue of using the CDI approach of creating the application or if this is Vaadin standard behaviour. Actually I expected the http-session to close when app.close is called… 