marking authenticationcontrol.httpsession as transient to avoid problems...

... when serializing. #4