Lately, we've been seeing a type of attack where the attacker tries to make as much sessions as possible, which can cause a server to run out of disk space. Because the requests are empty POST's, they throw a TokenMismatchException. When this happens on a website that doesn't see much traffic, the garbage collector is rarely run, so the old session files are rarely deleted.

To fix this, I've moved the collectGarbage call to above the point where any exception might be thrown.