You introduced constant SESSION_ATTR_USER_OBJ. Why are you not using it?