Remove unnecessary synchronization

See the thread referred to in issue #1629 for more info
may be worth adding a comment saying how we don't sync here because the underlying HttpSession does the sync for us, that will help us in a few years when we look at this and wonder why we don't call `synchronized` :)