Thus, when coming into your application via http OR https, you end up using an instance of this ProductController class. It does not, however, mean that it is the same instance somehow shared across webapps as you alluded to earlier. It simply means that you have two objects of the same type, one in each container.
I hope I haven't missed something - does this help clear the issue up for you? If it does not, what is the actual problem you're experiencing? i.e.: why is this behavior an issue for you?