J2EE authentication

Hi,
  Just a quick question about j2ee... I have a J2EE system that
allows anybody to create their own client applications to connect
(providing access only to stateless session beans).

What would be the best way to secure this application? At the moment
when the client logs in they recieve a UserSession object, which
contains information about their connection. Whenever they then
execute a command they will send this object to the server to ensure
that they are logged in...

My question is how can I be sure that the command being recieved is
coming from the same client who logged in (and not somebody who has
created their own UserSession object with someone elses details).

I hope I made myself clear....

cheers for your help.

SAMPLE CODE:

******* ****** UserSessionHandler.java

public UserSession login(String username, String password)
{
  //check the db
  if(details correct)
  {
      UserSession session = new UserSession(username);
      //set some more details....
      return session;
  }
  else
      throw new Exception("Invalid credentials");
}

********** ******* ProductSessionObject.java

public Collection getAllProducts(UserSession session)
{
 if(isLoggedIn(session))
  //do stuff

}