Bringing state back to web services: HttpSession-scope