In addition to the comments in #9:
- set default uploadr name to a unique UUID
- added two timestamps in the session (created and lastUsed) so it will be easy to create a quartz job to cleanup the session based on lastUsed (or created)
- added a lastAction in the session (render, upload, download, delete) in the default controller