Afaik any Hibernate object stored in the HTTPSession will be Hibernate-detached between HTTP requests. It is not refreshed/merged automatically on a new HTTP request, so it will be outside the Hibernate session on the second request which is probably not what you want.
It is generally a much better idea to store the object id in the session and recreate it at the beginning of each new HTTP request. Tapestry has some features to make this easy for you, but that's beyond my expertise (search the mailing list). Szemere