We have a load balancer (a plugin in the webserver) that balances based
on whether there is a session cookie; if there is a session cookie, the
request is not load balanced, if there is no session cookie, the
request is a new request hence the load balancer (using round-robin
algorithm) sends the request to one of two Weblogic nodes.

When Weblogic times out a session, the browser can send a request with
a stale cookie which is then treated as a new login request by weblogic
and sends the user to the form-based login JSP. Even though this is a
new login, this request is not load balanced because there is a session
cookie, though it is invalid. Effectively, after the first login of a
user, there is no load balancing for his/her sessions even after
session timeouts.

On a session timeout, I want to send a redirect page to the browser.
The redirect page clears the session cookie and then sends a new login
request. Which is why I need the session cookie. I believe
ServletAuthentication.getSessionCookie may work, though I haven't
gotten it to work yet.