Why does flushOnSessionInvalidation not work on JBoss EAP 5?

Issue

• We're experiencing problems with our web apps in regards to authentication being cached in EAP 5.1.0. Users can still login with their old password after a password reset, for a duration of ~30 minutes. This did not occur in JBoss 4.0.5. We are specifying flushOnSessionInvalidation when we define the security-domain in our jboss-web.xml file. Logout is done by calling HttpRequest.getSession().invalidate(). After this, trying to re-access the application yields the login page. However, invoking jboss.security:service=JaasSecurityManager.getAuthenticationCachePrincipals("myApp") shows our user as still being in the cache.
• Why is the user's JAAS cache entry not getting flushed from the JAAS cache?