code: protected void clearAndReinitializeSession() {
          final VaadinRequest currentRequest = VaadinService.getCurrentRequest();
          final UI currentUI = UI.getCurrent();
          if (currentUI != null) {
              final Transport transport = currentUI.getPushConfiguration().getTransport();
              if (Transport.WEBSOCKET.equals(transport) || Transport.WEBSOCKET_XHR.equals(transport)) {
                  LOGGER.warn(
                      "Clearing and reinitializing the session is currently not supported when using Websocket Push.");
                  return;
              }
          }
          if (currentRequest != null) {
              LOGGER.debug("Clearing the session");
              final WrappedSession session = currentRequest.getWrappedSession();
              final String serviceName = VaadinService.getCurrent().getServiceName();
              final Set<String> attributesToSpare = new HashSet<String>();
              attributesToSpare.add(serviceName + ".lock");
              attributesToSpare.add(VaadinSession.class.getName() + "." + serviceName);
              for (String s : currentRequest.getWrappedSession().getAttributeNames()) {
                  if (!attributesToSpare.contains(s)) {
                      LOGGER.trace("Removing attribute {} from session", s);
                      session.removeAttribute(s);
                  }
              }
              LOGGER.debug("Reinitializing the session {}", session.getId());
              VaadinService.reinitializeSession(currentRequest);
              LOGGER.debug("Session reinitialized, new ID is {}",
                  VaadinService.getCurrentRequest().getWrappedSession().getId());
          } else {
              LOGGER
                  .warn("No VaadinRequest bound to current thread, could NOT clear/reinitialize the session after login");
          }
      }
docs: Clears the session of all attributes except some internal Vaadin attributes and reinitializes it. If Websocket
  Push is used, the session will never be reinitialized since this throws errors on at least
  Tomcat 8.