LDEV-2475 Changing the implementation to use the temp dir specified in the config table instead of the java default. This means that the temp dir has to be cleaned for every restart of the lams server
LDEV-2472 according to stacktrace, hibernate flushes session at beginning of findById(userId) call, so don't remove child object until after any hibernate ops
LDEV-2449 invalidate session when user has lost their cookie, so we don't accidentally access a page without knowing the right session id/cookie value (for some reason jboss gets confused and returns a 'Session already invalidated' error in an exception)
