marking authenticationcontrol.httpsession as transient to avoid problems when serializing. #4