request.removeAttribute("dispatcher");
request.removeAttribute("security");
request.removeAttribute("authz");
// now empty out the session
session.invalidate();
session = request.getSession(true);
// setup some things that should always be there
UtilHttp.setInitialRequestInfo(request);