Is this the right handling of `null`, or should it be doing a `Validate.notNull(session, "Session shall not be null, dude.")` ?  Genuinely asking, I didn't go looking at null handling patterns in this code. :)