In AuthenticateAction._process(...), we have the following code:

I don't know if the comment is wrong or the action is wrong.
We invalidate the session if it already exists, but if we create a new one, it is not invalidated.

To analyze...