Ensure session is locked during cleanup (#10569)

* At the same time ensures request timer handling is done while session is locked (#10108)

Change-Id: Ifc36e1ac66d02e25fe98616319c014137bd94c10