After talking with Erik Hatcher a bit, I'm a bit worried about how I'm storing the current user's information. Basically, I'm putting a UserForm (extends ValidatorForm) into the session, and keeping it there to retrieve any user information I might need - in particular the userId. This is not the same as the user's login name, or the value I get from request.getRemoteUser(). How do you do this? I need the user's id from database lookups and filtering drop-downs, etc.