ConcurrentLoginFilter doesn't correctly detect logouts across multiple browsers

with quickstart and 2 browsers
1. browser 1, login as admin
2. browser 2, login as editor
3. browser 2 , logout
4. browser 1, logout
5. browser 1, login as editor > show "User already logged in" < WRONG
6. browser 2, login as admin > show "User already logged in" < WRONG

steps 1,2 and 3,4 and 5,6 are interchangeable.

Tested with Tomcat 6 and Jetty 6.