Improve concurrency of requests for the same session when using distributed web sessions

Many people are encountering lock timeouts when using the asynchronous servlet API in concert with distributed web sessions.
Our default configuration (pessimistic, REPEATABLE_READ isolation) effectively serializes access to the session.
Currently, we require locking on every request, since all requests involve updating the last access timestamp of the session. We should relax this constraint, such that only session attribute modifications require locking.