Make AuthenticationControl logger static and HttpSession final.
Override AuthenticationControl#toString so the admin can read it.
This is useful in some cases. For example:

Your application is deployed on Tomcat and you want to see its active
sessions via Tomcat Manager Application (/manager/html). If the
object stored in the session also overrides toString, you'll be able
to read them.