SessionRegistryImpl leaks principals under high load

There is a concurrency bug in SessionRegistryImpl where if you have multiple threads call registerNewSession concurrently with the same sessionId but different principal, sessionIds map will have one item but principals will have two.

Offending code is this:

                this.sessionIds.put(sessionId, new SessionInformation(principal, sessionId, new Date()));
		this.principals.compute(principal, (key, sessionsUsedByPrincipal) -> {
			if (sessionsUsedByPrincipal == null) {
				sessionsUsedByPrincipal = new CopyOnWriteArraySet<>();
			}
			sessionsUsedByPrincipal.add(sessionId);
			this.logger.trace(LogMessage.format("Sessions used by '%s' : %s", principal, sessionsUsedByPrincipal));
			return sessionsUsedByPrincipal;
		});

There is a cleanup code that is called just prior to this:

        if (this.getSessionInformation(sessionId) != null) {
            this.removeSessionInformation(sessionId);
        }

that is supposed to cleanup both maps from previous data but this whole section (removal -> addition) is not atomic so if two threads enter registerNewSession at the same time:

1. One of the threads will cleanup previous data
2. But the addition part
   this.sessionIds.put(sessionId, new SessionInformation(principal, sessionId, new Date()));
   will result in only thread adding into sessionIds (since sessionId is the same) but both threads will record data into principals since we have different principals.

Workaround is to make sure that you either use exactly the same Principal object or that Principal object implements equal() and hashCode().