WICKET-5380 Wicket rebinds the SessionEntry session attribute and this causes problems in Glassfish

Bind SessionEntry as an attribute in the http session only when freshly created.
Do not set it on every request because this causes notifications in Glassfish which are too early for the logic this HttpSessionBindingListener is used for.