Just a quick note: storing objects that are not thread safe in your session is asking for trouble. While Wicket does limit page processing to one request at a time, other requests like resources can run in parallel. What does this mean?

One thing that comes to mind is that when two requests for the same session are being processed, and one is done before the other it will detach the user model. What are the semantics now for the other thread?

For instance if you have a detachable model storing a User object in your session and use Hibernate you are in a world of hurt, or rather Hibernate will sometimes bork because your Session tries to attach the single User instance to multiple Hibernate Session objects. Exceptions will be having a party.

Now this is not meant as a Hibernate bashing reply, it just happens that Hibernate correctly detects multiple threads modifying the same object's state and stops tampering with it.

Martijn