renamed SessionFactory.getSession() methods w/o credentials to getInternalSession(), such that use is clear to devs
Tied the transaction ID to the servlet session, to prevent duplicate login (now that use consistently use servlet credentials at REST endpoints)
FedoraTransactionIT tests pass