bug in Tomcat 5.0.16

I discovered that the reason my sessionDestroyed() handler is called twice is, for a change, not due to my rauceus programming but because of the Tomcat version (5.0.16) I was using. The standard sessions manager expires timed out sessions twice, once when checking whether they have expired and again when, well, is on the job. Of course I'm sure you're not using that old a Tomcat version but just in case. See bugzilla issues 25234 and 27273 for more info. There's actually at least a couple more duplicate issues there.