Currently, multiple threads may be processing requests, due to Ajax. If they all access state stored in the HttpSession, the rsult can be invalid.
Tapestry should maintain a lock object inside the session, and automatically acquire a read lock the first time a request thread reads values from the session, and upgrade to a write lock when writing values to the session.
The lock can be released at the end of the request.
A reentrant read/write lock may be insufficient, as values inside the session are mutable; it is possible that the lock should be exclusive.