After a logout, the old session id is still valid.
if not used, a setting should exist to enforce the the cleaning of the session.