use session scope for storing session bean,
use spring security mechanism