After experiencing with the request I found out that the workaround for my problem is clearing the parameter map: request.getParameterMap().clear();
That works for my case but I'm interested whether this behaviour is correct? I would have expected that behaviour within the session.getAttribute("xxx"), but not in request.getParameter("xxx")