title: How to find the user to which a given HTTP session belongs
body: <h2>Intro:</h2>
  
  <p>I have a JIRA instance that is used by many external tools via REST. Some of these tools do not reuse the HTTP session they've created which results in the creation of a new session for each request.</p>
  
  <h2>Problem:</h2>
  
  <p>The creation of too many session results in unacceptable resource consumption. So I'm looking for a way to:</p>
  
  <ul>
  <li><p>restrict the misbehaving clients to not create too many sessions by rejecting their login attempts - thus forcing their owners to fix their clients</p></li>
  <li><p>Invalidate the old sessions thus freeing resources on the server</p></li>
  </ul>
  
  <p>But in order to do that <strong>I need to know to which user given session belongs</strong>, so when user X reaches the limit of lets say 5 session - I can either invalidate his older sessions or reject his request.</p>
  
  <h2>Question:</h2>
  
  <p>How can I map the sessions to users from <code>HttpSessionListener</code> ?
  Is there a better approach to achieving my goal ? Maybe something JIRA specific ?</p>