You would have to use session.removeAttribute( "cr" ), session.removeAttribute( "author" ) cannot be used because "author" is available in page scope. session.removeAttribute( "reciever" ) cannot be used because "reciver" would be in the request scope after the form is submitted.
2. Do I have to invalidate the session; i.e. session.invalidate(); after all the objects in the session are removed?
A single call to session.invalidate() will automatically remove all attached references. Of course you won't be able to use that session at all after that call - you will get an IllegalStateException. Bill