"After you invalidate a session, attempts by the browser to access the application will generate an invalid session exception until the session times out."
This can be solved by calling session.setMaxInactiveInterval(10) first, where 10 is the number of seconds for the session to time out. This seems to prevent a "session is invalid" error from occurring.