added ResponseFilter that after login puts the profile object in the session. The code is clean and none of the Session and Request handling is in the application