"Patents are granted by default. Inspection/testing and possible deletion of the patent only occurs if they are contested in court."
Yes, this. When progressing an application there will be search results returned, and you the inventor have to blag your way past these. It's not very difficult, as the search results seem like a keyword match. The patent inspectors have a pretty low threshold for blagging your way through search results and, particularly if you have "good" patent lawyers behind your applications, you'll get them through.
Now, if you are slapped with a cease-and-desist letter from a patent holder you have three options:
a) Stop doing whatever is allegedly infringing the patent
b) Negotiate royalties with the patent holder
c) Contest the patent
If you choose option (c) you have to decide whether to stop what you were doing while the legal process decides whether you are infringing: if you continue then you are liable to treble damages if you lose.
And it is this prospect of treble damages that makes this sort of suit so powerful: in many cases this effectively means that you're betting the farm on the outcome of a capricious patent court. Given that the C&D came in 2011, this is clearly the path Expedia have chosen.
Now IBM don't have to win these all, they only have to win one of them in order to end ahead. To my semi-educated eye, 346 seems to post-date a number of SSO offerings, so Expedia might have prior art. But 601 could be problematic, thinking about the world in 1996 I don't remember there being session management technologies available.
But Expedia wouldn't be contesting this if they didn't have some sort of prior art up their sleeve, I'm sure.