Invalid credentials can be used when a DAG is submitted to a session which has timed out

When a DAG is submitted to a session which has timed out, and the same DAG is then submitted to a new session - credentials associated with the old session can end up getting used.
Before we know that the session is no longer valid, the DAG is modified to add local resources and credentials.
On the next submission, since the DAG already has tokens (for HDFS for example) from the old session, the tokens are not updated.
Meanwhile, the old token would end up being cancelled by the RM - since the applicaiton associated with the previous session has finished.