[session] Stop relying on _sessions to synchronize living session
by doing what we currently do in pyramid. Also, attempt to synchronize CWUser's
class sounds like a dark corner case handling that should be removed in favor of
short lived user objects (beside it shouldn't occur except during migration).