For an application run by an application server, different approaches are possible. All of them requires at some point that you have a sessioning mechanism at hand. It should not be a problem since most, if not all, application servers offer such a mechanism.
Each option has its drawbacks: some are inherently bound to what they are, some are due to specific features not being implemented yet. Let's look at the details.