Zombie session after expiring cookies using Java Servlets

I have inherited some JAX-RS code with a logout function that appears to be properly "logging out" the user by redirecting to the login page, invalidating the session, and expiring the session cookies:

@POST
@Path("/logout")
public void logout(@Context HttpServletRequest req, @Context HttpServletResponse response) {
 
  req.getSession(false).invalidate();
  try {
      req.logout();
  } catch (ServletException e1) {
      e1.printStackTrace();
  }

  final Cookie[] cookies = req.getCookies();
  if (cookies != null) {
      for (final Cookie cookie : cookies) {
          cookie.setValue("");
          cookie.setPath("/");
          cookie.setMaxAge(0);
          response.addCookie(cookie);
     }
  }

  try {
      response.sendRedirect("/login");
  } catch (IOException e) {
      e.printStackTrace();
  }
}

However, if I fetch the below endpoint in curl after logging out, I can still get the username, implying that the cookies are still working:

@GET
@Produces(MediaType.APPLICATION_JSON)
@Path("/thisuser")
public Response thisUser() {
    
    try {
        return Response.status(Status.OK).entity(securityContext.getUserPrincipal().getName()).build();

    } catch (Exception e) {
        return Response.status(Status.FORBIDDEN).build();
    }
}

I am using this curl invocation but postman works too:

$ curl --location 'https://localhost:1234/thisuser' --header 'Cookie: JSESSIONID=[REDACTED]; LtpaToken2=[REDACTED]'

I have verified that:

• the cookies are properly served after logging in.
• after logging out in the browser, JSESSIONID has changed.
• If I substitute completely made up values in the cookies I can't fetch the thisuser endpoint.

Yet legitimate cookies are never expired. What am I missing in the code? What else can I try?

Using IBM WebSphere Application Server 8.5. Java 1.8, and Servlet Spec 3.0.