Magnolia CMS Public and Session Scope Bean

For few days I'm trying to solve my problem with Magnolia and Spring session beans, after many hours I do not have more ideas what can be wrong.

I'm developing simple application based on Magnolia 5.2.4 working on tomcat 7.0.5. I'm also using Blossome together with Spring MVC

The problem I'm having, appears only on Public for anonymous user and it's about session Bean which I'm using to keep all logged use data - yes, I'm not using spring security to not make things more complicated. So I have my session scope bean which stores for example logged user data. Which I'm retrieving from the bean on the jsp pages etc.

1. When I type http://ift.tt/1yJZgDw after user is logged ( and session bean is filled with user data) is seems that I'm getting some new session bean, because user data is empty ( = null). When I make some action like http://ift.tt/1DCUQNP or even http://ift.tt/1yJZgDw the right controller is triggered and I'm getting the right session bean with user data which I filled just after he is logged in. What's more http://ift.tt/1yJZgDw do not behave as http://ift.tt/1yJZevz

2. When I log-out, clean user data stored in sessionBean (sessionBean.setUserData(null); ) and invalidate session ( request.getSession().invalidate) sometimes I'm getting the 'old' user data. Even on other computer, I can intercept user logged on other machine. So - I'm clicking 'log out' and the controller and jsp doesn't find any user data ( what is correct) but when I change my action to http://ift.tt/1DCUO8D old session beans returns with logged out user data. On Author for superuser it works just fine.......

Does anybody has an idea what is wrong ? I was trying with anonymous user magnolia rights, but this is not it as I think.

Best Regards Jan