LPS-36750: request.getSession() in SessionMessages.java: 378 CWE 384