You could be hitting this bug:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCus46997/?referring_site=bugquickviewredir
The work around is noted in the BugID as follows:
Workaround:
Disable session monitoring globally by giving 'no access-session template' or 'no access-session monitor'
First command to be used if box is in legacy mode.
Second command to be used if box is in new-style mode.
Mode can be found out using below exec CLI.
Router#authentication display config-mode
Current configuration mode is legacy
Router#authentication display config-mode
Current configuration mode is new-style
