#1026. Added checks to ensure that we are not attempting to use session
if it is not allowed.  Added the concept of
SessionlessHttpServletRequestWrapper, which now gets set in the
StatelessSessionFilter.  This will throw an exception if a call to
retrieve a session is invoked.