Clarify session object (HttpSession instance) lifetime requirements

There is a practice of synchronizing on the session object. http://stackoverflow.com/a/616723/1341535 even mentions books advocating this.
The servlet specification is somewhat vague on what is the lifetime of a session instance. As seen in JAVASERVERFACES-3734, this part of 7.7.1 Threading issues:

Multiple servlets executing request threads may have active access to the same session object at the same time.

can be taken to mean that the HttpSession instance remains the same between requests.
There is also 7.3 Session scope:

HttpSession objects must be scoped at the application (or servlet context) level.

In actuality some servlet containers implement HttpSession as just a wrapper around the real session object, and create an instance of the wrapper for each request. I know that Undertow does this. Spring's utils mention that the same instance is not guaranteed, so there are probably others.

"Session object" is used quite liberally throughout the spec. Another example is in 7.7.2 Distributed Environments:

The Container Provider can ensure scalability and quality of service features like
load-balancing and failover by having the ability to move a session object, and its
contents, from any active node of the distributed system to a different node of the
system.

In this case session object definitely doesn't mean session instance. It's not clear what's the difference between a session object and session object's contents here. Seems like both refer to the same thing.

I suggest amending the quoted parts for clarity.