I'm dealing with a legacy Java application with a large, fairly messy codebase. There's a fairly standard 'User' object that gets stored in the HttpSession between requests, so the servlets do stuff like this at the top: HttpSession session = request.getSession(true); User user = (User)session.getAttribute("User"); The old user authentication…