code: public void dissolve() {
          if (state == State.SESSION_DISSOLVED) {
              return;
          }
          if (handler.sessionFree() || sessionPassThrough) {
              return;
          }
          if (null == session) {
              // only case is when CSRF token check failed
              // while resolving session
              // we need to generate new session anyway
              // because it is required to cache the
              // original URL
              // see RedirectToLoginUrl
              session = new H.Session();
          }
          localeResolver.dissolve();
          app().eventBus().emit(new SessionWillDissolveEvent(this));
          try {
              setCsrfCookieAndRenderArgs();
              sessionManager().dissolveState(session(), flash(), resp());
  //            dissolveFlash();
  //            dissolveSession();
              state = State.SESSION_DISSOLVED;
          } finally {
              app().eventBus().emit(new SessionDissolvedEvent(this));
          }
      }
docs: Dissolve session and flash into cookies.
  <p><b>Note</b> this method must be called
  before any content has been committed to
  response output stream/writer</p>