Site Mesh creates a Tomcat session even when it does nothing. Check PageFilter.doFilter:

            // force creation of the session now because Tomcat 4 had problems with
            // creating sessions after the response had been committed
            if (Container.get() == Container.TOMCAT) {
                request.getSession(true);
            }

This is fine for the web application, because we always have a session. When doing REST (/rest/) and Plugins (/plugins/servlet/) we don't always have session (especially in relation to REST where calls may come from non-web browser clients). This creates a new session per request that is left around to timeout. This had bad effects when using the dashboard plugin (JRA-18664).

We no longer use sitemesh for REST. We left it on the servlet plugins because we actually have a use case (the OAUTH GUI).

We need to find a way to get sitemesh not to create sessions when the page is not going to be decorated. Couple of ideas:

1. Change sitemesh not to have this session code, provided that it works.
2. Only sitemesh a special part of the REST API URL namespace (e.g. /rest/ui/*).

Good night and goodluck.