Metacat

    private HttpSession getSession(HttpServletRequest request, 

                            String username, String password)  

                            throws IllegalStateException {

      // get the current session object, create one if necessary

      HttpSession sess = request.getSession(true);

      // if it is still in use unvalidate and get a new one

        sess = request.getSession(true);

      }

      // store username & password in the session for later use if necessary

      sess.putValue("username", username);

      sess.putValue("password", password);