Assuming that the session.invalidate() is not working.
FlexContext.getFlexSession() should be returning the session object
for the new user and not the object of the old user who logged off,
more over when another user logs in, shouldn't the
userSession.setAttribute("userid", userid) be overwriting the value
with new userId ??
Can you please check out if something else is going wrong.
Hope this helps.