I just discovered that every request in an ASP.Net web application gets a Session lock at the beginning of a request, and then releases it at the end of the request!
Marking a controller's session state as readonly or disabled will solve the problem.
You can decorate a controller with the following attribute to mark it read-only:
[SessionState(System.Web.SessionState.SessionStateBehavior.ReadOnly)]
the System.Web.SessionState.SessionStateBehavior enum has the following values: