Fixed the locking in ConnectionRecogniserImpl. Again.

Database calls are made outside the lock, with the exception of
{get,set}ConnectionWindow(), which seems to be unavoidable if we want
to ensure replay protection within and across sessions.