Are you running in the JBoss appserver? If see, JBoss Cache based session replication is standard; all you need to do to use it is run the 'all' config and add an empty "distributable" element to your web.xml.
To answer your question, #2 is the only workable solution. Locks are obtained at the node level; if all the sessions are in one node you'll endless have lock conflicts.
That helps. Thanks