WL-3444 : NPE check

Not really related to this patch, but putting a Site object into a session is bad. The site object can be quite large and it's generally much better to just stash a site ID in the session and look it up on each request.