I have been puzzled with this problem for long time. There is one simpler solution to this. After you logout, you would link to other page. This page shall be specified by spelling out from the application name. I suppose this will turn the Glassfish server engine to clear all session cookies? (I am not an expert on Glassfish.)
[Message sent by forum member 'marioyamaguchi' (mario-yamaguchi_at_sakamura.org)]
http://forums.java.net/jive/thread.jspa?messageID=368897