There're many best practices for securing web-apps in the Java source
(java.sun.com) or others. JAAS is a powerfull/nice way to go but you
have not to implement even a line of JAAS in 90% of cases, you just
use it as your Servlet Container exposes to you. Look for how to
secure web  applications in Tomcat e.g.
Try not to use HttpSession as your application  should handle many
aspects of security  itself. Let alone (if) your container
implementation uses HttpSession/cookies/... to handle the stuff.