It is all about managed persistence. In the second example the related object is being managed by Hibernate. In the first example it is not.
In the first example you would be required to set both sides of the relationship. You many to many mapping is bi-directional, and in your first example you set only one of those directions.
In the second example since both sides of the association is loaded via the Session and therefore both being managed, they have both sides set.
So because only one side is set in the first example, it only knows how to update that side of the relationship and not the other side. The other side would update that side of the relationship in the database.
After reading your post and the part of Hibernate Documentation about bi-directional associations I understand the problem.
(Also realized that the "inverse" in the User.hbm.xml should not be there at all)
Thank you very much.