HttpServletRequest.getRequestedSessionID() is incorrectly returning a newly generated session ID instead of the requested ID in EAP 7 when using URL session tracking.

Reproduction:

• deploy attached test.war.
• access http://localhost:8080/test/
  (or modify the host:port as necessary)

It makes two calls to request.getRequestedSessionId(), one before creating a session and one after.
These should both print null (since no jsessionid was passed on the URL). But instead the second prints the new ID.

Or access http://localhost:8080/test/;jsessionid=test
This should print "test" twice, but instead the second prints the new ID.

The issue appears to be specific to URL session tracking, and was not reproduced when using COOKIE tracking.

The issue is specific to EAP 7 and does not occur on EAP 6.