The number of sessions wasn't always incremented but it was always decremented. This happened primarily when authentication failed. By making the management of the counters a part of the object lifecycle, this problem goes away.