Your test case runs as expected against GFv2UR1 in my environment.
My guess is your browser didn't accept the cookie. If the cookie isn't being used, then that implies url rewriting. Because this case is simple and there are no URLs with the session info encoded to re-access your test, the container assumes the session wasn't joined and returns this result.
I'm guessing if you add a link with the href value as:
<% out.print(response.encodeURL("test.jsp")); %>
Make the initial request, then click the link, you'll see session.isnew=false attr=testval
[Message sent by forum member 'rlubke' (rlubke)]
http://forums.java.net/jive/thread.jspa?messageID=280843