This commit removes constructor that takes session id instead of session object for the entire `AbstractSessionEvent` hierarchy. The ability to create `AbstractSessionEvent` instances with no underlying session object leads to NPE when interacting with `HttpSession` obtained from `HttpSessionEvent`. See gh-499 Closes gh-939