CF10 keeps on calling onSessionStart

Hi,

I moved a site from CF 8 to CF10. CF8 resided in a different server.  I put a WriteOutput(" testing") in the onSessionStart function of the Application.cfc to know how the site will behave. I ran the site, on the default page the the "testing" appeared. When I clicked on the SignIn page, the "testing" word appeared again. It's calling the onSession start. Here is what's in my onSessionStart.

<cffunction name="onSessionStart" returntype="void">

  <cfif NOT StructKeyExists( cookie,"CFID" ) OR NOT StructKeyExists( cookie,"CFTOKEN" )>

  <cfheader name="Set-Cookie"  value="CFID=#session.CFID#; Expires=#GetHttpTimeString(DateAdd("yyyy", 40, Now()))#; Path=/;SECURE;HTTPOnly;">

  <cfheader name="Set-Cookie"  value="CFToken=#session.CFToken#; Expires=#GetHttpTimeString(DateAdd("yyyy", 40, Now()))#; Path=/;SECURE;HTTPOnly;">

  </cfif>

  <cfscript>

  WriteOutput("testing");

  StructClear(session);

  session.pageRedirector = ""; //used for sending a user back to a previous requested page when authentication is required first

  session.profile = CreateObject("component","mysite.cfcs.user");

  session.shoppingCart = CreateObject("component","mysite.cfcs.cart");

  session.catalog = CreateObject("component","mysite.cfcs.catalog");

  </cfscript>

</cffunction>

I'm using CSRFGenerateToken() to verify the page, so if the application keeps on calling the onSessionStart, the session will always be cleared and the user was not able to login.

Here are some of the variables:

  <cfscript>

  this.name="mysite";

  this.clientmanagement=false;

  this.sessionmanagement=true;

  this.setclientcookies=false;

  this.sessiontimeout="#CreateTimeSpan(0,0,40,0)#";//TODO: revert back to 40 mins as default

  this.applicationtimeout="#CreateTimeSpan(0,1,0,0)#";

  this.loginStorage = "Session";

  this.logFile = "mysite_LOG";

  this.scriptProtect = "all";

  </cfscript>

To fix the issue, I set setclientcookies to true. The session lost issue is solved but it gave a new issue - session is not terminated on browser exit.

IIS version is = IIS 8.5

OS version = Win server 2012 R2

If anybody can give some ideas, I would deeply appreciate it.

Thank you in advance.