Thanks, I found the problem. It is related to the Debian PHP5 package, which handle session garbage collection different than other Linux distributions.

From the php.ini:

Code
; This is disabled in the Debian packages, due to the strict permissions
; on /var/lib/php5.  Instead of setting this here, see the cronjob at
; /etc/cron.d/php5, which uses the session.gc_maxlifetime setting below
;session.gc_probability = 0
session.gc_divisor     = 100

I replaced:

Code
;session.gc_probability = 0

with:

Code
session.gc_probability = 1

and the sessions gets now automatically cleared