hsa: fix http server session cleanup