Hey,
Again you have a great foundation here in place. It would be cool to see some more integration with the UserSession.java cacheable object. This way your not going to the DB to check for a session for every request that comes in. I see you have the framework in place but it would be cool to see how to use it the proper way. This is just a feature request and does not require immediate action. Just a nice to have, maybe even a blog post touching on it.
Thanks for the great work!