code: @Override
  	public User getCurrentUser() {
  		HttpSession session = getRequest().getSession(false);
  
  		if (session == null)
  			return null;
  
  		return (User) session.getAttribute(SESSION_ATTR_USER);
  	}
docs: INSTANCE SCOPE ==========================================================