Improve channel manager performance when jcr session login is slow

In preview mode, CmsSecurityValve was designed/implemented to get a new JCR session every time by using the stored JCR credentials of the CMS user. When using LDAP plugin however, this behavior results in a LDAP communication for each request, causing a very poor performance in channel preview.

While the default behavior cannot be improved in shorter term, it may be possible to fix the performance issue by storing a wrapper of the JCR session object into an HttpSession attribute and reuse it whenever available. The JCR session stored in HttpSession should not to be logged out after request processing (e.g., CleanupValve). Also, the wrapper object should implement javax.servlet.http.HttpSessionBindingListener to log out when unbound from the http session (in order to avoid a potential memory leak).