+ now a UserSession object is available in the HttpSession (although it
doesn't contain much yet)