diff --git a/jetty-security/src/main/java/org/eclipse/jetty/security/authentication/SessionAuthentication.java b/jetty-security/src/main/java/org/eclipse/jetty/security/authentication/SessionAuthentication.java
index 74f143b05f0..260d5ddd3f5 100644
--- a/jetty-security/src/main/java/org/eclipse/jetty/security/authentication/SessionAuthentication.java
+++ b/jetty-security/src/main/java/org/eclipse/jetty/security/authentication/SessionAuthentication.java
@@ -119,16 +119,23 @@ public class SessionAuthentication implements Authentication.User, Serializable,
 
     public void sessionWillPassivate(HttpSessionEvent se)
     {
+       
     }
 
     public void sessionDidActivate(HttpSessionEvent se)
     {
         if (_session==null)
+        {
             _session=se.getSession();
+        }
     }
 
     public void valueBound(HttpSessionBindingEvent event)
     {
+        if (_session==null)
+        {
+            _session=event.getSession();
+        }
     }
 
     public void valueUnbound(HttpSessionBindingEvent event)