UNDERTOW-170 Don't expose io.undertow attributes to the Servlet HttpSession