NB: It is important that you register the org.acegisecurity.ui.session.HttpSessionEventPublisher in web.xml so that this class is notified of sessions that expire.
web.xml