Added session-level locking around the update(batch) and onRequest() functions.  onRegister() is locked because the session_id is not returned until the object is fully constructed.
Limiting to 20 outstanding sessions.  Timeout is 30 seconds.