If I request a static resource, a session gets created. For example:

$ curl https://extranet.atlassian.com/images/icons/edit_20.png -D -
HTTP/1.1 200 OK
Date: Wed, 09 Mar 2011 05:48:48 GMT
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"828-1299108332000"
Last-Modified: Wed, 02 Mar 2011 23:25:32 GMT
Content-Type: image/png
Content-Length: 828
Set-Cookie: JSESSIONID=DDBD821B57F7CFE373C9B0D73F4C1226; Path=/
Cache-Control: max-age=2419200
Expires: Wed, 06 Apr 2011 05:48:48 GMT

I know sitemesh creates sessions, but does this need to go through sitemesh? Also, even if it is sitemesh, I'm pretty sure the code that creates a session in sitemesh can be dumped, there's a comment on top of it saying that it has to be done for tomcat 4... If a session hasn't been created by the time sitemesh needs to access the session, as far as I'm concerned, sitemesh doesn't need to access the session.