In a set of SOAP web services the user is authenticated with custom SOAP header (username/password). Each time the user call a WS the following Auth method is called to authenticate and retrieve User object from NHibernate session:

[...]
public Services : Base {
    private User user;

    [...]
    public string myWS(string username, string password) 
    {
        if( Auth(username, password) ) { [...] }
    }
}

public Base : WebService {

   protected static ISessionFactory sesFactory;
   protected static ISession session;

   static Base {
     Configuration conf = new Configuration();
            [...]
     sesFactory = conf.BuildSessionFactory();
   }

    private bool Auth(...) {    

        session = sesFactory.OpenSession();

        MembershipUser user = null;
            if (UserCredentials != null && Membership.ValidateUser(username, password)) 
            {
             luser = Membership.GetUser(username);
            }
        ...
        try {
      user = (User)session.Get(typeof(User), luser.ProviderUserKey.ToString()); 
 } catch {
      user = null;
             throw new [...]
        }

        return user != null; 
     }

}

When the WS work is done the session is cleaned up nicely and everything works: the WSs create, modify and change objects and Nhibernate save them in the DB.

The problems come when an user (same username/password) calls the same WS at same time from different clients (machines). The state of the saved objects are inconsistent.

How do I manage the session correctly to avoid this? I searched and the documentation about Session management in NHibernate is really vast. Should I Lock over user object? Should I set up a "session share" management between WS calls from same user? Should I use Transaction in some savvy way?

Thanks

Update1

Yes, mSession is 'session'.

Update2

Even with a non-static session object the data saved in the DB are inconsistent. The pattern I use to insert/save object is the following:

var return_value = [...];
try {
  using(ITransaction tx = session.Transaction)
  {
    tx.Begin();

    MyType obj = new MyType();
    user.field = user.field - obj.field; // The fields names are i.e. but this is actually what happens.

    session.Save(user);
    session.Save(obj);

    tx.Commit();

    return_value = obj.another_field;
  }
} catch ([...]) {
    // Handling exceptions...   
} finally {
    // Clean up
    session.Flush();
    session.Close();
}

return return_value;

All new objects (MyType) are correctly saved but the user.field status is not as I would expect. Even obj.another_field is correct (the field is an ID with generated=on-save policy).

It is like 'user.field = user.field - obj.field;' is executed more times then necessary.