Agreement in UA call today:

Add a similar statement like this one for SecureChannel to the Session:

"Each SecureChannel exists until it is explicitly closed or until the last token has expired and the overlap period has elapsed. A Server application should limit the number of SecureChannels. To protect against misbehaving Clients and denial of service attacks, the Server shall close the oldest SecureChannel that has no Session assigned before reaching the maximum number of supported SecureChannels"

Allow CloseSession on not activated session.

Add issue to create a compliance test for the new statement and to change compliance test for CloseSession.

Added to 5.6.2 CreateSession:

A Server application should limit the number of Sessions. To protect against misbehaving Clients and denial of service attacks, the Server shall close the oldest Session that is not activated before reaching the maximum number of supported Sessions.

5.6.3 ActivateSession

Added clarification that CloseSession can be called on not activated sessions.

Added to 5.6.4 CloseSession:

When the CloseSession Service is called before the Session is successfully activated, the Server shall reject the request if the SecureChannel is not same as the one associated with the CreateSession request.

Reviewed in Tuesday telecon and agreed to close.