protected void endSession() {
   session.clearAttributes();
   session.invalidate();
   session = null;
 }