Properly set notificationId when notifying a client about a reserveTimeout
Only let the application create a HttpSession when needed. This avoids a session being created by Spring Security for every soap request.