HttpSessionContext.destroy(Contextual<?> contextual) should always check the underlying HttpSession

Right now, AttributeBeanStore.remove(BeanIdentifier) does not remove a bean instance created in a different HTTP request.

See also http://lists.jboss.org/pipermail/weld-dev/2016-September/003487.html.