diff -r 09d518d313b7 -r 022ff91bde60 src/luan/modules/http/Http.luan
--- a/src/luan/modules/http/Http.luan	Thu Sep 08 16:38:30 2016 -0600
+++ b/src/luan/modules/http/Http.luan	Thu Sep 08 18:25:43 2016 -0600
@@ -153,7 +153,7 @@
 end
 
 function M.clear_session()
-	M.request.java.getSession().removeAttribute("luan")
+	M.response.remove_cookie "session"
 end
 
 

diff -r 09d518d313b7 -r 022ff91bde60 src/luan/modules/http/HttpServicer.java
--- a/src/luan/modules/http/HttpServicer.java	Thu Sep 08 16:38:30 2016 -0600
+++ b/src/luan/modules/http/HttpServicer.java	Thu Sep 08 18:25:43 2016 -0600
@@ -5,6 +5,7 @@
 import java.io.PrintWriter;
 import java.io.IOException;
 import java.util.Map;
+import java.util.LinkedHashMap;
 import java.util.Set;
 import java.util.List;
 import java.util.ArrayList;
@@ -13,12 +14,12 @@
 import java.util.Enumeration;
 import java.util.concurrent.Executor;
 import java.util.concurrent.Executors;
+import java.util.concurrent.atomic.AtomicInteger;
 import javax.servlet.ServletOutputStream;
 import javax.servlet.ServletException;
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
 import javax.servlet.http.Part;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -40,6 +41,14 @@
 public final class HttpServicer {
 	private static final Logger logger = LoggerFactory.getLogger(HttpServicer.class);
 
+	public static long sessionTimeout = 60*60*1000L;  // one hour
+	private static AtomicInteger sessionCounter = new AtomicInteger();
+	private static Map<String,LuanState> sessionMap = new LinkedHashMap<String,LuanState>() {
+		protected boolean removeEldestEntry(Map.Entry<String,LuanState> eldest) {
+			return (Long)eldest.getValue().registry().get("sessionTimeout") < System.currentTimeMillis();
+		}
+	};
+
 	public static boolean service(LuanState luan,HttpServletRequest request,HttpServletResponse response,String modName)
 		throws LuanException
 	{
@@ -54,14 +63,19 @@
 			if( !(mod instanceof LuanFunction) )
 				throw new LuanException( "module '"+modName+"' must return a function" );
 			if( Boolean.TRUE.equals(per_session_pages.rawGet(mod)) ) {
-				HttpSession session = request.getSession();
-				LuanState sessionLuan = (LuanState)session.getAttribute("luan");
+				LuanState sessionLuan = null;
+				Cookie cookie = getCookie(request,"session");
+				if( cookie != null )
+					sessionLuan = sessionMap.get(cookie.getValue());
 				if( sessionLuan!=null ) {
 					luan = sessionLuan;
 				} else {
 					LuanCloner cloner = new LuanCloner(LuanCloner.Type.COMPLETE);
 					luan = (LuanState)cloner.clone(luan);
-					session.setAttribute("luan",luan);
+					luan.registry().put( "sessionTimeout", System.currentTimeMillis() + sessionTimeout );
+					String key = Integer.toString(sessionCounter.incrementAndGet());
+					setCookie(request,response,"session",key,false,null);
+					sessionMap.put(key,luan);
 				}
 				fn = (LuanFunction)PackageLuan.require(luan,modName);
 			} else {