The new request triggered by <jsp:include ...> can easily avoid the
Thread Local Session management Filter.

The answer is in Servlet 2.4 spec at SRV.6.2.5:
"... By using the new <dispatcher> element in the deployment descriptor,
the developer can indicate for a filter-mapping whether he would like
the filter to be applied to requests when:
1. The request comes directly from the client. ...
2.  ... 
3. The request is being processed under a request dispatcher ... using
an include() call. ...
4. ...

Mapping the Filter like this in web.xml:
  ...
  <filter-mapping>
    <filter-name>TLSessionManagementFilter</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
  </filter-mapping>
  ...

It won´t intercept the <jsp:include> internal requests - Avoiding the
premature session closing.