You're putting the request, response, and session into instance variables. There is only one instance of the servlet. So *every single request* is using the *same* request, response, and session values: overwriting them, reading from them, etc.
See
here for more information; this is very basic
Java web app stuff. There are a lot of other resources on the web covering this topic, this just happens to be among the first I found on Sun's website.