[HttpFoundation] implement different locking strategies for sessions