| A TokenStateHolder that stores flow state in the HTTP Session.
This is, unexpectedly, an application scope bean. The HttpSession object
stored inside is an AOP alliance proxy for the actual request-scope session.
It is app-scope since alternative TSH implementations are also app-scope,
and cross-scope overriding is not supported. Also having one less request bean
is desirable.
NB Expiryseconds not yet implemented. Would require *extra* server-side
storage of map of tokens to sessions, in order to save long-term storage
within sessions - awaiting research from performance clients.
author:
Antranig Basman (antranig@caret.cam.ac.uk) | 