[session] Stop relying on _sessions to synchronize living session by doing what we currently do in pyramid. Also, attempt to synchronize CWUser's class sounds like a dark corner case handling that should be removed in favor of short lived user objects (beside it shouldn't occur except during migration).

[test] Drop useless access to repo._sessions test still succeed afterwards.

[repo] Fix flake8 errors in server/__init__.py