What I'm looking for

Should have posted this here instead of the forum. Sorry.
 
My problems with container security (I'm new to servlets, but an
experienced programmer) are below. I'm using tomcat 4+. 
 
1. No portable way to make the jsessionid cookie persistent across
browser sessions on the user's machine. Why the hell did the servlet
spec people do that? 
 
2. No way force-sign on a user without sending him to a protected
resource. 
 
3. No portable way to create your own user principle which carries info
beyond name/roles. 
 
I could be wrong about the above. But does this sound right? I'm
thinking of writing my own session manager, using my own cookies and
using a servlet filter to a) protect a tree of resources b) control the
user session cookie c) 'signon' users when and how I like. 
 
Am I the 1st person to encounter this, or the 50,000-th?