I alway close a session when I finish a query or a transaction. In fact, I will open a session and close a session multiple times to handle a http request.
Secondly, all my database operations are handle in the data access layer. I donot think that it is good to put hibernate session into a http session. If to do so, we do not need n-tier.