I see your point, but the cleanup() and removeState() is somehow partially duplicated, introduce more methods to do the job sometime lead a bad shape for later refactoring, so over the time, hope the internal APIs can be cleanup a little bit.
Also, even if it's small object to add, but for site that handles millions calls a day, the session timeout happened a lot, in that case, it could still build up the memory a lot faster.