Session lock

[jessepeterson]

Consider adding a global token session lock for a given DEP name. This would prevent race conditions with trying to acquire a session at the same time at the expense of locking every DEP query (because we don't know if a given query will require fetching a new session token). See also micromdm/micromdm#850.