If Session is static, it contains *all* users from *all* devices. Made it a non-static property of LoginBean so it's always around in each device's browser session.