Index: src/edu/ucsb/nceas/metacat/MetaCatServlet.java
===================================================================
--- src/edu/ucsb/nceas/metacat/MetaCatServlet.java	(revision 4294)
+++ src/edu/ucsb/nceas/metacat/MetaCatServlet.java	(revision 4295)
@@ -56,6 +56,7 @@
 import javax.servlet.ServletContext;
 import javax.servlet.ServletException;
 import javax.servlet.ServletOutputStream;
+import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -605,7 +606,7 @@
 
 					// Decode the docid and mouse click information
 					// THIS IS OBSOLETE -- I THINK -- REMOVE THIS BLOCK
-					// 4/12/2007
+					// 4/12/2007d
 					// MBJ
 					if (name.endsWith(".y")) {
 						docid[0] = name.substring(0, name.length() - 2);
@@ -643,10 +644,10 @@
 				// This block handles session management for the servlet
 				// by looking up the current session information for all actions
 				// other than "login" and "logout"
-				String username = null;
+				String userName = null;
 				String password = null;
-				String[] groupnames = null;
-				String sess_id = null;
+				String[] groupNames = null;
+				String sessionId = null;
 				name = null;
 
 				// handle login action
@@ -683,73 +684,26 @@
 
 					// aware of session expiration on every request
 				} else {
-					// TODO MCD take a closer look at this
-					HttpSession sess = request.getSession(true);
-					SessionData sessionData = null;
-					logMetacat.info("session.isnew: " + sess.isNew()
-							+ "    params.hassessid: " + params.containsKey("sessionid"));
-					if (sess.isNew() && !params.containsKey("sessionid")) {
-						// session expired or has not been stored b/w user
-						// requests
-						logMetacat.info("The session is new or no sessionid is assigned. " 
-								+ "The user is public");
-						sessionData = new SessionData(sess.getId(), "public", null, null);
-						SessionService.registerSession(sessionData);											
-					} else {
-						logMetacat.info("The session is either old or "
-								+ "has sessionid parameter");
-						try {
-							
-							if (params.containsKey("sessionid")) {
-								sess_id = ((String[]) params.get("sessionid"))[0];
-								logMetacat.info("in has sessionid " + sess_id);
-								if (SessionService.isSessionRegistered(sess_id)) {
-									logMetacat.info("find the id " + sess_id
-											+ " in hash table");
-									sessionData = SessionService.getRegisteredSession(sess_id);
-								}
-							} else {
-								// this makes sure there is a session object for
-								// public sessions
-								sess_id = sess.getId();
-								sessionData = new SessionData(sess.getId(), 
-										(String) sess.getAttribute("username"), 
-										(String[]) sess.getAttribute("groups"),
-										(String) sess.getAttribute("password"));
-								SessionService.registerSession(sessionData);
-							}
-						} catch (IllegalStateException ise) {
-							logMetacat.error("Error in handleGetOrPost: this shouldn't "
-									+ "happen: the session should be valid: "
-									+ ise.getMessage());
-						}
+					SessionData sessionData = RequestUtil.getSessionData(request);
+					
+					userName = sessionData.getUserName();
+					password = sessionData.getPassword();
+					groupNames = sessionData.getGroupNames();
 
-						username = (String) sess.getAttribute("username");
-						logMetacat.info("The user name from session is: " + username);
-						password = (String) sess.getAttribute("password");
-						groupnames = (String[]) sess.getAttribute("groupnames");
-//						name = (String) sess.getAttribute("name");
-					}
-
-					// make user user username should be public
-					if (username == null || (username.trim().equals(""))) {
-						username = "public";
-					}
-					logMetacat.info("The user is : " + username);
+					logMetacat.info("The user is : " + userName);
 				}
 				// Now that we know the session is valid, we can delegate the
-				// request
-				// to a particular action handler
+				// request to a particular action handler
 				if (action.equals("query")) {
 					ServletOutputStream streamOut = response.getOutputStream();
 					PrintWriter out = new PrintWriter(streamOut);
-					handleQuery(out, params, response, username, groupnames, sess_id);
+					handleQuery(out, params, response, userName, groupNames, sessionId);
 					out.close();
 				} else if (action.equals("squery")) {
 					ServletOutputStream streamOut = response.getOutputStream();
 					PrintWriter out = new PrintWriter(streamOut);
 					if (params.containsKey("query")) {
-						handleSQuery(out, params, response, username, groupnames, sess_id);
+						handleSQuery(out, params, response, userName, groupNames, sessionId);
 						out.close();
 					} else {
 						out.println("Illegal action squery without \"query\" parameter");
@@ -761,8 +715,8 @@
 							.debug("******************* SPATIAL QUERY ********************");
 					ServletOutputStream streamOut = response.getOutputStream();
 					PrintWriter out = new PrintWriter(streamOut);
-					handleSpatialQuery(out, params, response, username, groupnames,
-							sess_id);
+					handleSpatialQuery(out, params, response, userName, groupNames,
+							sessionId);
 					out.close();
 
 				} 
@@ -770,27 +724,27 @@
 
 					logMetacat
 							.debug("******************* DATA QUERY ********************");
-					handleDataquery(params, response, sess_id);
+					handleDataquery(params, response, sessionId);
 				}
 				else if (action.equals("export")) {
 
-					handleExportAction(params, response, username, groupnames, password);
+					handleExportAction(params, response, userName, groupNames, password);
 				} else if (action.equals("read")) {
-					handleReadAction(params, request, response, username, password,
-							groupnames);
+					handleReadAction(params, request, response, userName, password,
+							groupNames);
 				} else if (action.equals("readinlinedata")) {
-					handleReadInlineDataAction(params, request, response, username,
-							password, groupnames);
+					handleReadInlineDataAction(params, request, response, userName,
+							password, groupNames);
 				} else if (action.equals("insert") || action.equals("update")) {
 					PrintWriter out = response.getWriter();
-					if ((username != null) && !username.equals("public")) {
+					if ((userName != null) && !userName.equals("public")) {
 						handleInsertOrUpdateAction(request, response, out, params,
-								username, groupnames);
+								userName, groupNames);
 					} else {
 						response.setContentType("text/xml");
 						out.println("<?xml version=\"1.0\"?>");
 						out.println("<error>");
-						out.println("Permission denied for user " + username + " "
+						out.println("Permission denied for user " + userName + " "
 								+ action);
 						out.println("</error>");
 					}
@@ -797,9 +751,9 @@
 					out.close();
 				} else if (action.equals("delete")) {
 					PrintWriter out = response.getWriter();
-					if ((username != null) && !username.equals("public")) {
-						handleDeleteAction(out, params, request, response, username,
-								groupnames);
+					if ((userName != null) && !userName.equals("public")) {
+						handleDeleteAction(out, params, request, response, userName,
+								groupNames);
 					} else {
 						response.setContentType("text/xml");
 						out.println("<?xml version=\"1.0\"?>");
@@ -814,16 +768,16 @@
 					out.close();
 				} else if (action.equals("setaccess")) {
 					PrintWriter out = response.getWriter();
-					handleSetAccessAction(out, params, username);
+					handleSetAccessAction(out, params, userName);
 					out.close();
 				} else if (action.equals("getaccesscontrol")) {
 					PrintWriter out = response.getWriter();
-					handleGetAccessControlAction(out, params, response, username,
-							groupnames);
+					handleGetAccessControlAction(out, params, response, userName,
+							groupNames);
 					out.close();
 				} else if (action.equals("getprincipals")) {
 					PrintWriter out = response.getWriter();
-					handleGetPrincipalsAction(out, username, password);
+					handleGetPrincipalsAction(out, userName, password);
 					out.close();
 				} else if (action.equals("getdoctypes")) {
 					PrintWriter out = response.getWriter();
@@ -855,7 +809,7 @@
 					out.println(MetaCatVersion.getVersionAsXml());
 					out.close();
 				} else if (action.equals("getlog")) {
-					handleGetLogAction(params, request, response, username, groupnames);
+					handleGetLogAction(params, request, response, userName, groupNames);
 				} else if (action.equals("getloggedinuserinfo")) {
 					PrintWriter out = response.getWriter();
 					response.setContentType("text/xml");
@@ -862,7 +816,7 @@
 					out.println("<?xml version=\"1.0\"?>");
 					out.println("\n<user>\n");
 					out.println("\n<username>\n");
-					out.println(username);
+					out.println(userName);
 					out.println("\n</username>\n");
 					if (name != null) {
 						out.println("\n<name>\n");
@@ -869,17 +823,17 @@
 						out.println(name);
 						out.println("\n</name>\n");
 					}
-					if (LDAPUtil.isAdministrator(username, groupnames)) {
+					if (LDAPUtil.isAdministrator(userName, groupNames)) {
 						out.println("<isAdministrator></isAdministrator>\n");
 					}
-					if (LDAPUtil.isModerator(username, groupnames)) {
+					if (LDAPUtil.isModerator(userName, groupNames)) {
 						out.println("<isModerator></isModerator>\n");
 					}
 					out.println("\n</user>\n");
 					out.close();
 				} else if (action.equals("buildindex")) {
-					handleBuildIndexAction(params, request, response, username,
-							groupnames);
+					handleBuildIndexAction(params, request, response, userName,
+							groupNames);
 				} else if (action.equals("login") || action.equals("logout")) {
 					/*
 					 * } else if (action.equals("protocoltest")) { String
@@ -1142,7 +1096,7 @@
                     + " into hash in login method");
             SessionService.registerSession(id, 
 					(String) session.getAttribute("username"), 
-					(String[]) session.getAttribute("groups"),
+					(String[]) session.getAttribute("groupnames"),
 					(String) session.getAttribute("password"));
         }
         
@@ -1187,6 +1141,7 @@
                     + sess.getAttribute("username")
                     + " will be invalidate in logout action");
             sess.invalidate();
+            SessionService.unRegisterSession(sess.getId());
         }
         
         // produce output
