code: public ISession createSession(String sessionId, boolean newId) {
          //create local variable - JIT performance improvement
          final boolean isTraceOn = com.ibm.websphere.ras.TraceComponent.isAnyTracingEnabled();
          //need some way to checkForDuplicateCreatedIds or synchronize on some object or something ... look at in-memory
          if (isTraceOn && LoggingUtil.SESSION_LOGGER_WAS.isLoggable(Level.FINER)) {
              StringBuffer sb = new StringBuffer("id = ").append(sessionId).append(appNameForLogging);
              LoggingUtil.SESSION_LOGGER_WAS.entering(methodClassName, methodNames[CREATE_SESSION], sb.toString());
          }
          if (inProcessOfStopping) {
              throwException("SessionContext.createWhenStop");
          }
          BackedSession session = null;
          session = createSessionObject(sessionId);
          session.updateLastAccessTime(session.getCreationTime());
          session.setInsert(); // flag new session for insertion into store
          session.setMaxInactiveInterval((int) _smc.getSessionInvalidationTime());
          session.setUserName(ANONYMOUS_USER);
          _sessions.put(sessionId, session);
          //        if (session.duplicateIdDetected) { // could happen on zOS if key is defined incorrectly - perhaps doesn't include appname
          //                                           // other than that, this really should never happen - duplicate ids should not be generated
          //            LoggingUtil.SESSION_LOGGER_CORE.logp(Level.WARNING, methodClassName, methodNames[CREATE_SESSION], "Store.createSessionIdAlreadyExists");
          //            session = null;
          //        }
  
          if (isTraceOn && LoggingUtil.SESSION_LOGGER_WAS.isLoggable(Level.FINER)) {
              LoggingUtil.SESSION_LOGGER_WAS.exiting(methodClassName, methodNames[CREATE_SESSION], "session = " + session);
          }
          return session;
      }
docs: /*
  createSession - ensures that a newly generated id is not a duplicate and
  also ensures if another thread just created the session, we return it rather
  than creating another.