Thread-safe in Session scope

The Session object is shared among all threads initiated by the same user. This may cause problems when objects are accessed concurrently e.g. when the user opens a second browser tab of the application.

Concurrency problems are hard to discover.