TYRUS-259: do not explicitly create HttpSession