Thanks, I found the problem. It is related to the Debian PHP5 package, which handle session garbage collection different than other Linux distributions.
From the php.ini:
; This is disabled in the Debian packages, due to the strict permissions
; on /var/lib/php5. Instead of setting this here, see the cronjob at
; /etc/cron.d/php5, which uses the session.gc_maxlifetime setting below
;session.gc_probability = 0
session.gc_divisor = 100
I replaced:
;session.gc_probability = 0
with:
session.gc_probability = 1
and the sessions gets now automatically cleared