После выхода из системы заходит под неизвестным пользователем

 <?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="3.0"
    xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
    <display-name>JSF.KMB</display-name>
    <context-param>
        <description>
        The location where state information is saved.
Valid values are 'server' (typically saved in HttpSession) and 'client' (typically
saved as a hidden field in the form.
Default is server.</description>
        <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
        <param-value>client</param-value>
    </context-param>
    <context-param>
        <param-name>
            javax.faces.DATETIMECONVERTER_DEFAULT_TIMEZONE_IS_SYSTEM_TIMEZONE</param-name>
        <param-value>true</param-value>
    </context-param>
    <context-param>
        <description>
        Comma-delimited list of context-relative resource paths under which the JSF implementation
will look for application configuration resources, before loading a configuration resource
named /WEB-INF/faces-config.xml (if such a resource exists).</description>
        <param-name>javax.faces.CONFIG_FILES</param-name>
        <param-value></param-value>
    </context-param>
    <context-param>
        <description>
        The default suffix for extension-mapped resources that contain JSF components.
Default is '.jsp'.</description>
        <param-name>javax.faces.DEFAULT_SUFFIX</param-name>
        <param-value>.xhtml</param-value>
    </context-param>
    <context-param>
        <description>
        A human readable string describing where this particular JSF application is
in the software development lifecycle.
Valid values are 'Development', 'UnitTest', 'SystemTest' and 'Production'.
Default is 'Production'.
This parameter is not available in JSF 1.x.</description>
        <param-name>javax.faces.PROJECT_STAGE</param-name>
        <param-value>Development</param-value>
    </context-param>
    <description>--Page renderer--</description>
    <context-param>
        <param-name>facelets.LIBRARIES</param-name>
        <param-value>/WEB-INF/myPager.taglib.xml</param-value>
    </context-param>
    <context-param>
        <description>
        Monitors Faces JSP files for modifications and synchronizes a running server with
the changes without restarting the server. If this parameter is set to false or
removed from the deployment descriptor, any changes made to Faces JSP files may
not be seen by the server until it is restarted. This parameter is usually set
to true while the Faces JSP files are being developed and debugged in order to
improve the performance of the development environment.</description>
        <param-name>com.ibm.ws.jsf.JSP_UPDATE_CHECK</param-name>
        <param-value>true</param-value>
    </context-param>
    <context-param>
        <description>
        Load JSF runtime when the application server starts up. If this parameter is set to false or removed,
JSF runtime will be loaded and initialized when the first JSF request is processed.
This may disable custom JSF extensions, such as factories defined in the project.</description>
        <param-name>com.ibm.ws.jsf.LOAD_FACES_CONFIG_AT_STARTUP</param-name>
        <param-value>true</param-value>
    </context-param>
    <servlet>
        <servlet-name>Faces Servlet</servlet-name>
        <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
        <load-on-startup>-1</load-on-startup>
        <enabled>true</enabled>
        <async-supported>false</async-supported>
    </servlet>
    <servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>*.faces</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>/faces/*</url-pattern>
    </servlet-mapping>
    <welcome-file-list>
        <welcome-file>forIndex.faces</welcome-file>
    </welcome-file-list>
    <security-constraint>
        <display-name>Users</display-name>
        <web-resource-collection>
            <web-resource-name>pages</web-resource-name>
            <url-pattern>/</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
        </web-resource-collection>
        <auth-constraint>
            <role-name>Users</role-name>
        </auth-constraint>
    </security-constraint>
    <security-role>
        <role-name>Users</role-name>
    </security-role>
    <security-role>
        <role-name>Admins</role-name>
    </security-role>
    <login-config>
        <auth-method>FORM</auth-method>
        <form-login-config>
            <form-login-page>/login.faces</form-login-page>
            <form-error-page>/loginError.faces</form-error-page>
        </form-login-config>
    </login-config>
    <security-constraint>
        <display-name>Admins</display-name>
        <web-resource-collection>
            <web-resource-name>pages</web-resource-name>
            <url-pattern>/</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
        </web-resource-collection>
        <auth-constraint>
            <role-name>Admins</role-name>
        </auth-constraint>
    </security-constraint>
    <icon>
        <small-icon>/resources/images/favicon (2).png</small-icon>
        <large-icon>/resources/images/favicon (2).png</large-icon>
    </icon>
</web-app>

FacesContext fc = FacesContext.getCurrentInstance();
HttpSession session = (HttpSession) fc.getExternalContext().getSession(false);
session.invalidate();