[FIXED SECURITY-75] Invalidate session after login to avoid session f…

…ixation

core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java

@@ -85,6 +85,7 @@ protected void onSuccessfulAuthentication(HttpServletRequest request, HttpServle
         // HttpSessionContextIntegrationFilter stores the updated SecurityContext object into this session later
         // (either when a redirect is issued, via its HttpResponseWrapper, or when the execution returns to its
         // doFilter method.
+        request.getSession().invalidate();
         request.getSession();
     }