spring security session not behaving as expected - spring-mvc

Question

I've just gone through implementing a SessionCounterListener in my spring mvc webapp as per http://www.mkyong.com/servlet/a-simple-httpsessionlistener-example-active-sessions-counter/ .
I am seeing some behavior that I did not expect and have two questions.
Question 1.
When I hit my login.jsp for the first time after server restart, the session counter by 1 even before I login (not expected).
For example when I go to the login page...
sessionCreated - add one session into counter:1
And then when I go to hit the log out button the session count is decreased by one (which is fine) but immediately after the session count is increased by 1 (not expected).
For example when I hit the logout button...
sessionDestroyed - deduct one session from counter:0
sessionCreated - add one session into counter:1
It is as if everytime I go to the login page the count is increased by 1. I would expect that the count is only increased after successful login.
Can someone help me understand what is happening here?
Question 2.
When I log in as a different user in my application whilst the first user is still logged in I don't get a new session counter. i.e. I don't think it is not creating a new sessions for the new user.
Again I need help to understand please.
Here is my spring security settings....
<http pattern="/login.htm" security="none"/>
<http use-expressions="true" auto-config="false" entry-point-ref="loginUrlAuthenticationEntryPoint">
<!-- custom filters -->
<custom-filter position="FORM_LOGIN_FILTER" ref="twoFactorAuthenticationFilter" />
<custom-filter ref="securityLoggingFilter" after="SECURITY_CONTEXT_FILTER"/>
<!-- session management -->
<session-management
invalid-session-url="/sessionExpired.htm"
session-authentication-error-url="/alreadyLoggedIn.htm">
<concurrency-control
max-sessions="1"
expired-url="/sessionExpiredDuplicateLogin.htm"
error-if-maximum-exceeded="false" />
</session-management>
<!-- error handlers -->
<access-denied-handler error-page="/accessDenied.htm"/>
<!-- logout -->
<logout logout-success-url="/logout.htm" invalidate-session="true" delete-cookies="JSESSIONID" />
<!-- authorize pages -->
<intercept-url pattern="/home.htm" access="isAuthenticated()" />
<intercept-url pattern="/shortsAndOvers.htm" access="isAuthenticated()" />
<intercept-url pattern="/shortsAndOversDaily.htm" access="isAuthenticated()" />
<intercept-url pattern="/birtpage.htm" access="isAuthenticated()" />
<intercept-url pattern="/reports/show.htm" access="isAuthenticated()" />
</http>
<beans:bean id="loginUrlAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<beans:property name="loginFormUrl" value="/login.htm" />
</beans:bean>
<beans:bean id="successHandler" class="com.me.reporting.security.CustomSavedRequestAwareAuthenticationSuccessHandler">
<beans:property name="defaultTargetUrl" value="/home.htm" />
</beans:bean>
<beans:bean id="failureHandler" class="com.me.reporting.security.CustomSimpleUrlAuthenticationFailureHandler">
<beans:property name="defaultFailureUrl" value="/loginfailed.htm" />
</beans:bean>

Answer 1

you probably are thinking about session in different context.
take a look at JSESSION cookie in firebug while clicking around your application, maybe it will give you some answers :)
HttpSessionListener probably is invoked each time JSESSIONID changes, so:
You get to login.jsp page - session is created, JSESSIONID changes, sessionCreated is invoked. You are loggin out: sessionDestroyed is invoked, session is invalidated ( not sure here, just guessing ), counter is decreased. But what happens after login out? You are probably redirected to /logout.htm and new session is created.