GPII-609: Fix for mishandling of sessions which causes them to become in...

...accessible to clients not holding the cookie returned from logon. All flowManager request handlers reorganised to defer to the LifecycleManager's sessions - some new methods support these

@kaspermarkus, @colinbdclark - ready for review