add lock for requests with the same session_id to prevent race conditions