We should get the bot killer plugin bundled in OnDemand (in all apps). It reduces the idle timeout for sessions that are tied to one-off requests. It may be a workaround rather than a fix to the underlying session creation issue, but it's worth having nonetheless as a safety measure, since we can't guarantee we can eliminate all unnecessary session creations. Not yet sure whether this should be in the standalone products by default, or just in OnDemand.

This issue is tracking bundling for use in JIRA