Login com filter - JSF e Hibernate

select
        usuario0_.id as id1_,
        usuario0_.perfil_id as perfil2_1_,
        usuario0_.name as name1_,
        usuario0_.email as email1_,
        usuario0_.username as username1_,
        usuario0_.password as password1_ 
    from
        changescontrol.usuario usuario0_ 
    where
        usuario0_.username=? 
        and usuario0_.password=?

public class UsuarioDaoImpl implements UsuarioDao {

    @Override
    public boolean isValidLoginAndPassword(String username,String password) {
        boolean valid;
        Session session = HibernateUtil.getSessionFactory().openSession();
        session.beginTransaction();
        Query query = session.createQuery("from Usuario usr where usr.username=:user and usr.password=:pass");
        query.setString("user", username);
        query.setString("pass", password);
        Usuario usr = (Usuario) query.uniqueResult();
        valid = (usr != null);
        session.getTransaction().commit();
        session.close();
        return valid;
    }

}

@ManagedBean(name="loginBean")
@SessionScoped
public class LoginBean {
    
    private Usuario usuario;
    private String user;
    private String password;


    public LoginBean() {
        
        /*if (this.usuario == null) {
            this.usuario = new Usuario();
        }*/
    }
    
    
    public String login() {
        UsuarioDao usuarioDao = new UsuarioDaoImpl();
        if (usuarioDao.isValidLoginAndPassword(user, password)) {
            FacesContext.getCurrentInstance().getExternalContext().getSessionMap().put("user", "ok");
            return "index.jsf";
        } else {
            return "reloadError";
        }
    }

    public Usuario getUsuario() {
        if (usuario == null){
            usuario = new Usuario();
        }
        return usuario;
    }

    public void setUsuario(Usuario usuario) {
        this.usuario = usuario;
    }  
  
}

usuarioDao.isValidLoginAndPassword(user, password)

usuarioDao.isValidLoginAndPassword(usuario.getUsername(), usuario.getPassword())

@ManagedBean(name="loginBean")
@SessionScoped
public class LoginBean {
    
    private Usuario usuario;

    public LoginBean() {
        
        if (this.usuario == null) {
            this.usuario = new Usuario();
        }
    }
        
    public void redirecionar() throws IOException{    
       FacesContext faces = FacesContext.getCurrentInstance();
        ExternalContext context = faces.getExternalContext();
        context.redirect("/ControleChanges/index.jsf");   
    }  
    
    public void login(ActionEvent actionEvent) throws IOException {
        RequestContext context = RequestContext.getCurrentInstance();
        FacesMessage msg = null;
        boolean loggedIn = false;
        
        UsuarioDao usuarioDao = new UsuarioDaoImpl();
        usuario = usuarioDao.buscarPorUsuario(usuario);

        if (usuario != null) {
            loggedIn = true;
            FacesContext.getCurrentInstance().getExternalContext().getSessionMap().put("user", "ok");
            redirecionar();
            msg = new FacesMessage(FacesMessage.SEVERITY_INFO, "Welcome", usuario.getUsername()); //"Usuario"
        } else {
            loggedIn = false;
            msg = new FacesMessage(FacesMessage.SEVERITY_WARN, "Login Error", "Invalid credentials");
        }

        FacesContext.getCurrentInstance().addMessage(null, msg);
        context.addCallbackParam("loggedIn", loggedIn);
    }

    public Usuario getUsuario() {
        if (usuario == null){
            usuario = new Usuario();
        }
        return usuario;
    }

    public void setUsuario(Usuario usuario) {
        this.usuario = usuario;
    }
    
    
}

public class UsuarioDaoImpl implements UsuarioDao {
   
    @Override
    public Usuario buscarPorUsuario(Usuario usuario) {
        Session session = HibernateUtil.getSessionFactory().openSession();
        String sql = "select u from Usuario u where username=:user and password=:pass";
        Query query = session.createQuery(sql);
        query.setString("user", usuario.getUsername());
        query.setString("pass", usuario.getPassword());
        return (Usuario) query.uniqueResult();
    }
}

public class AuthFilter implements Filter {

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest rq = (HttpServletRequest) request;
        HttpServletResponse rp = (HttpServletResponse) response;
        boolean auth = rq.getSession().getAttribute("user") != null;

        if (!auth && !rq.getRequestURL().toString().contains("login.jsf")) {
            rp.sendRedirect(rq.getContextPath() + "/login.jsf");
        } else {

            try {
                chain.doFilter(request, response);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
    }

    public void destroy() {
    }

    public void init(FilterConfig config) throws ServletException {
    }
}

<filter>
  	<filter-name>Filtro Login</filter-name>
  	<filter-class>package.AuthFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>Filtro Login</filter-name>
    <url-pattern>/pages/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
    <dispatcher>FORWARD</dispatcher>
    <dispatcher>INCLUDE</dispatcher>
    <dispatcher>ERROR</dispatcher>
  </filter-mapping>

<filter>
        <display-name>AuthFilter</display-name>
        <filter-name>AuthFilter</filter-name>
        <filter-class>com.changes.util.AuthFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>AuthFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

static class Car {
        public String name;
        public Car(String name) {
            this.name = name;
        }
        public Car(Car other) {
            if (other != null)
                this.name = other.name;
        }
    }
    
    public static void main(String[] args) {
        Car c = null;
        
        Car c2 = c; //cópia da instância
        Car c3 = new Car(c); //cópida do objeto
        
        if (c2 != null)
            System.out.print("not ");
        System.out.println("is null");

        if (c3 != null)
            System.out.print("not ");
        System.out.println("is null");
        
    }

is null
not is null