0.12.2dev: in session handling, try to avoid table deadlocks (#9705)
- in `Session.save`, split `save_session` transaction in two (actually save the session, then eventually purge the expired sessions)
- always access tables in the same order, first `session`, then `session_attribute`
