     <p>Should a session always be used once a user is authenticated? This
        may offer some performance benefits since the session can then be used
        to cache the authenticated Principal, hence removing the need to
        authenticate the user via the Realm on every request. This may be of
        help for combinations such as BASIC authentication used with the
        JNDIRealm or DataSourceRealms. However there will also be the
        performance cost of creating and GC'ing the session. If n