don't store private public-share-key in session

proposed solution for #12405 

cc @DeepDiver1975 @LukasReschke @MorrisJobke what do you think?
(This is different in regard to the AppFramework which has the `UseSession` annotation to keep the session open for you)