Sticky hazelcast sessions cause memory leak

Issue Summary

Using hazelcast.http.sessions=sticky configuration causes OOM error due to stale HTTP sessions never getting destroyed. Setting server.session.timeout to a lower value doesn't help either.

This is reproducible on Data Center: yes

Steps to Reproduce

1. Set hazelcast.http.sessions=sticky
2. Set server.session.timeout=60
3. Open an incognito window in the browser
4. Login to Bitbucket application
5. Close the incognito window without logout.
6. Wait for more than 1 minute.
7. Repeat this process few thousand times using a script or a selenium test.

Expected Results

The application should keep running without an error.

Actual Results

The login eventually fails due to an OOM error.

Workaround

Use hazelcast.http.sessions=local and enable sticky sessions at the Load Balancer level. (This is the default value)