When does the exception get thrown? And where from - what's the stacktrace in the server log? Does it work with other versions of JBoss/Tomcat?
I figured it out. I was using struts. The struts html package makes use of the session object I think. Since I didn't really need to use struts on that page, I removed it and that solved the problem. I was able to invalidate the session, and that logged out the user.