My explanation is simple : what all implicit objects are available to a jsp page?
out, request, response, session, config, application, pagecontext, page and exception
now see, session is already made available to you by default by the conatiner.
when you called the request.getSession(false) : it gives you the session as it is available.
if you want to turn off implicit session, use this:
<%@ page import="" session="false" %>
let me know if there is any confusion