Problema session Hibernate Login JSF

public class PessoaDAO {

	private Session session;

	private Logger logger = Logger.getLogger(PessoaDAO.class);

	public PessoaDAO(Session session) {
		logger.info("Construtor" + session);
		this.session = session;
	}

	public boolean isValidLoginAndPassword(String loginEmail, String password){
		boolean valid = false;
		
		System.out.println("DAO metodo isValidLoginAndPassword...");
		
		System.out.println("DAO session.isOpen() >>> " + session.isOpen());
		
		Query query = session.createQuery("from Pessoa pessoa where pessoa.loginEmail = :le and pessoa.password = :pw");
		query.setString("le", loginEmail);
		query.setString("pw",  password);
		Pessoa pessoa = (Pessoa) query.uniqueResult();

		if(pessoa != null){
			valid = true;
		}
		System.out.println("DAO Pessoa >>> " + pessoa);
			
		session.getTransaction().commit();
		session.close();
		
		return valid; 
	}

public class PessoaFace {
	
	private Pessoa pessoa = new Pessoa();

	private String senha;
	
	private String loginEmail; 
	
	private String nome;

	private Long selectedId;
	
	public String doLogin() throws Exception {
        boolean logado = false;
        
        Session session = HibernateUtil.currentSession();
        
        System.out.println("face > metodo doLogin() > session.isOpen() >>> " + session.isOpen());
        
        PessoaDAO pessoaDAO = new PessoaDAO(session);
                
        HttpSession ses = (HttpSession) FacesContext.getCurrentInstance().getExternalContext().getSession(false);
        HttpServletResponse rp = (HttpServletResponse) FacesContext.getCurrentInstance().getExternalContext().getResponse();
        
        System.out.println("face > loginEmail >>>>>> " + this.loginEmail);
        System.out.println("face > senha >>>>>> " + this.senha);

        logado = pessoaDAO.isValidLoginAndPassword(this.loginEmail, TransformaStringMD5.md5(senha));

        if(logado){
            ses.setAttribute("user", logado);
            rp.sendRedirect("http://localhost:8080/sistema/principal/principal.faces");

            return "toPrincipal";
        }else{
            ses.setAttribute("user", null);
            ses.removeAttribute("user");
            rp.sendRedirect("http://localhost:8080/sistema/login/login.faces");
            return "toLogin";
        }
    }

<h:panelGrid columns="2">
					<h:outputText value="Login" styleClass="rotulos" />
					<h:inputText id="login" value="#{pessoaFace.loginEmail}" required="true" styleClass="edit" size="90" style=" width : 150px;"/>
										
					<h:outputLabel for="senha" value="Senha " styleClass="rotulos"/>
					<h:inputSecret id="senha" styleClass="edit" validatorMessage="A senha deve ter no mínimo 6 caracteres!" value="#{pessoaFace.senha}" size="60" style=" width : 150px;">
						<f:validateLength minimum="6"/>
					</h:inputSecret>
					
					<h:commandButton id="botao" value="Entrar" action="#{pessoaFace.doLogin}" />
					<h:message for="login"/>
					<h:message for="senha"/>
			</h:panelGrid>

public class AuthFilter implements Filter {

	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest rq = (HttpServletRequest) request;
        HttpServletResponse rp = (HttpServletResponse) response;
        boolean auth = rq.getSession().getAttribute("user") != null;
       
        if (!auth && !rq.getRequestURL().toString().contains("login.jsf")) {
            rp.sendRedirect("http://localhost:8080/sistema/pages/principal/principal.jsf");
        } else {

            try {
                chain.doFilter(request, response);
            } catch (Exception e) {
                System.out.println("Exception no chain.doFilter");
                e.printStackTrace();
            }
        }
    }