Allow WebFilter subclasses to override HazelcastHttpSession creation

Split of creation of new HazelcastHttpSession instances to a protected method
to allow subclasses to return a customized version of HazelcastHttpSession.
Merge pull request #3370 from mheemskerk/allow-override-of-httpsession

Allow WebFilter subclasses to override HazelcastHttpSession creation