code: protected Object setAttribute(HttpSession session, String key, Object object, boolean serializable, int maxTime) {
          if (object == null) {
              // If object is null, remove attribute.
              Object ret;
              synchronized (session) {
                  ret = session.getAttribute(key);
                  session.removeAttribute(key);
              }
              return ret;
          }
          else {
              // Set object in session.
              Object ret;
              synchronized (session) {
                  ret = session.getAttribute(key);
                  session.setAttribute(key, object);
              }
              SessionMapper mapper = (SessionMapper) session.getAttribute(MAPPER_ATTRIBUTE);
              if (mapper == null) {
                  // Register mapper for session.
                  mapper = new SessionMapper();
                  session.setAttribute(MAPPER_ATTRIBUTE, mapper);
              }
              synchronized (mapper) {
                  // Update field mapper.
                  SessionFieldMapper fieldMapper = mapper.get(key);
                  if (fieldMapper == null) {
                      fieldMapper = new SessionFieldMapper(serializable && object instanceof Serializable);
                      mapper.put(key, fieldMapper);
                  }
                  if (maxTime > 0) {
                      // Register runnable to remove attribute.
                      if (fieldMapper.runnable != null) {
                          // Cancel old runnable because a new one will be created.
                          fieldMapper.runnable.cancel();
                      }
                      // Register runnable.
                      RemoveFieldRunnable runnable = new RemoveFieldRunnable(key, maxTime, session);
                      fieldMapper.runnable = runnable;
                      (new Thread(runnable)).start();
                  }
              }
              return ret;
          }
      }
docs: Saves an object in session for latter use.
  @param session Session in which to store object.
  @param key Key under which object is saved.
  @param object Object to save.
  @param serializable True if object is serializable.
  @param maxTime Maximum time to keep object in session.
  @return Object previously saved under key.