Actually, the question #3 was "what's more scalable". So I'd have to say Answer 2. But it's a trick, since HttpSession and
EJB Session don't refer to the same thing.
An EJB session is a general information repository, freely sharable by multiple users and by default existing for the life of the container.
An HTTP session is a repository for information shared between a single user's browser instance and the server. Its default lifetime is set by the application's web.xml.
Because an HttpSession object is not sharable - one must be created for each application user, it doesn't scale as well as Session EJBs, which are specifically designed to be shared.
The secret of how to be miserable is to constantly expect things are going to happen the way that they are "supposed" to happen.
You can have faith, which carries the understanding that you may be disappointed. Then there's being a willfully-blind idiot, which virtually guarantees it.