Invalidate session if deserialization failed

Describe the bug
Server always return 500 if session deserialization failed

org.springframework.data.redis.serializer.SerializationException: Cannot deserialize; nested exception is org.springframework.core.serializer.support.SerializationFailedException: Failed to deserialize payload. Is the byte array a result of corresponding serialization for DefaultDeserializer?; nested exception is org.springframework.core.NestedIOException: Failed to deserialize object type; nested exception is java.lang.ClassNotFoundException: com.example.security.WebAuthenticationDetails
	at org.springframework.data.redis.serializer.JdkSerializationRedisSerializer.deserialize(JdkSerializationRedisSerializer.java:84)
	at org.springframework.data.redis.core.AbstractOperations.deserializeHashValue(AbstractOperations.java:355)
	at org.springframework.data.redis.core.AbstractOperations.deserializeHashMap(AbstractOperations.java:299)
	at org.springframework.data.redis.core.DefaultHashOperations.entries(DefaultHashOperations.java:247)
	at org.springframework.data.redis.core.DefaultBoundHashOperations.entries(DefaultBoundHashOperations.java:183)
	at org.springframework.session.data.redis.RedisIndexedSessionRepository.getSession(RedisIndexedSessionRepository.java:457)
	at org.springframework.session.data.redis.RedisIndexedSessionRepository.onMessage(RedisIndexedSessionRepository.java:543)
	at org.springframework.data.redis.listener.RedisMessageListenerContainer.executeListener(RedisMessageListenerContainer.java:250)
	at org.springframework.data.redis.listener.RedisMessageListenerContainer.processMessage(RedisMessageListenerContainer.java:240)
	at org.springframework.data.redis.listener.RedisMessageListenerContainer.lambda$dispatchMessage$0(RedisMessageListenerContainer.java:987)

To Reproduce
Rename class to trigger ClassNotFoundException

Expected behavior
Invalidate current session and create a new session

Start at RedisIndexedSessionRepository.getSession, where the deserialization failure appears in the reported stack trace, and reproduce the issue by renaming the serialized class to trigger ClassNotFoundException. Trace how the current session is handled after deserialization fails; done means the invalid session is discarded and a new session is created instead of returning HTTP 500.