Dedupe does not update/delete Drupal sessions

When deduping a contact with an attached Drupal ID the old contact ID may survive in an existing Drupal session (i.e. if the user is logged in), causing contributions etc to be registered under the wrong (deleted) contact ID.

Example:

A person is registered with two contact IDs (5 and 6), with Drupal account ID 8 attached to contact ID 5. Contact 5 is merged into contact 6, including the Drupal account ID. However, the user is logged in, and in his Drupal session, the contact ID is still registered as 5, so when he registers for an event or makes a contribution, this is registered to the (deleted) contact ID 5. The event registrations and contributions are thus invisible to the administrator, but the user still gets receipts etc.

A solution would be to either delete all sessions with the Drupal contact ID of the user being merged (which is what I ended up doing manually), or load each of them and edit the stored contact ID to be the new one.