Remember that javax.jcr.Session is not a thread safe object. Never try to share it between threads.

Do not use System session from the user related code because a system session has unlimited rights. Call ManageableRepository.getSystemSession() from process related code only.

Call Session.logout() explicitly to release resources assigned to the session.

When designing your application, take care of the Session policy inside your application. Two strategies are possible: Stateless (Session per business request) and Stateful (Session per User) or some mix.