The utility Util/AppServHost is resetting the cookies with a JSESSIONID that is constant. This made Joshua receive my session!
AppServHost should use the same JSESSIONID suffix as is there when changing.