From: <glassfish_at_javadesktop.org>
Date: Fri, 11 Dec 2009 10:33:58 PST
I just confirmed that request.logon (as you said) does not establish an authentication session; independent of whether you create an HttpSession before you call login.
[Message sent by forum member 'monzillo' ]