Custom session management using apache shiro