Call to session.stop() with side-effect in UpdateAccessTokenFilter.java

While reviewing the code in UpdateAccessTokenFilter.java I stumbled upon the following lines

https://github.com/OHDSI/WebAPI/blob/093e1f197222fdd69aa56247b4f7c225257a69ed/src/main/java/org/ohdsi/webapi/shiro/filters/UpdateAccessTokenFilter.java#L118-L122

which struck me as odd. In fact, session.stop() is called only twice in the whole WebAPI code base, both times in this UpdateAccessTokenFilter class. Given UpdateAccessTokenFilter's place in the grand scheme of filters configured, the above lines seem to always be called upon login, and result in an immediate end of the session that actually just started... The rest of the user interactions seem to continue based on token authentication alone.

Code blame shows that the code itself and the surrounding parts are many years old.

Questions:

• Would it be possible to find more details on why the session.stop() was added here?
• Do we need sessions at all?

Start with src/main/java/org/ohdsi/webapi/shiro/filters/UpdateAccessTokenFilter.java, especially lines 118-122, then inspect its filter configuration and the history around the session.stop() call. Determine why the session is stopped during login and whether sessions are required; done means a documented decision with the relevant behavior validated.