[WebMacro-user

Hi all,

I am using webmacro to develop a web-based application.
Things seemed to work fine till yesterday. A customer complained that he 
managed to “see” the account of another customer when he logged-in using 
his own credentials (he send me a screen shot of the “view”).
By inspecting the log file I found that both users have been logged-in 
at the same time (the second customer logged in 3 sec after the first 
customer).
The system has more than 1000 customers but this inconvenience happened 
for the first time yesterday (?).
It seems that different sessions have been mixed up.
The servlet includes a handle method and uses several other methods 
(methods that write and read from a database).
All methods are defined in the same class (that extends WMServlet).
As far as I know servlets must not have instance variables (only local 
variables -inside methods- to prevent data corruption and 
inconsistencies). However in my servlet I use only one non local 
variable (a Logger) and I don't think this is the cause of the problem.
As an attached file I send you a fragment of the before mentioned servlet.
Can instance variables be defined in the case of a servlet that extends 
WMServlet? (I mean is it safe? or its not a good practice without 
keeping precautions?)
Do you have any idea what can have caused this inconvenience ?
Is the use of methods inside the servlet thread-safe ?

Please help!!!
Nikolaos Papadakis

public Template handle(WebContext context) throws HandlerException {		
		HttpServletRequest request = context.getRequest();
		HttpSession session=request.getSession();
		String userID = (String) session.getAttribute("USERID");

	
		// -----------------------ACTIONS---BEGIN----HERE-------------	
		if (isActionEqualTo("back",context)) {
			return returnMyTemplate("users/login.htm",context);
		}
		if (isActionEqualTo("remind",context)) {
			return returnMyTemplate("users/remind_passwd.htm",context);
		}

                if (isActionEqualTo("showRA",context) && userID != null) {
			return showJobs(context);
		}
		if (isActionEqualTo("sendPasswd",context)) {
			return remindPassword(context);
		}
		if (isActionEqualTo("register",context)) {
			return registerCustomer(context);
		}
ACTIONS Continue .. .. ..