This caused the bugs with force check in and view sessions. Those are the two pieces of code making the call above. They have been fixed with null checks for the returned identity from the session. To test the fix for bug 42370, I started up two lenya sessions on two different boxes at the same time with clean builds, except one didn't have the patch from r571481. I then: logged in, imported, viewed sessions, logged out, waited two hours, tried to log back in, got the stack dump for stale session, really logged in, viewed sessions. The one with the patch worked, the one without the patch didn't. I'm not entire sure what causes the problem, but expired sessions seem to be a possibility. I don't know if this is a bug, or just something we need to be aware of.