I do not have enough reputation to add a comment. But getAllPrincipals returns all principals including ones from expired sessions. Use some method like below to getAllActiveSessions.
private List getActiveSessions(SessionRegistry sessionRegistry) {
final List