SLING-2325 - using request attribute flag rather than impersonation to ensure that a session lives past the current request