A response is committed whenever an action on your part causes the
status code and headers to be written to the browser.  At that point,
because the status code and headers are already set, anything that tries
to alter the status code, or the headers will result in an
IllegalStateException being thrown.

Just hypothesizing here, but attempting to create a session probably
results in the code attempting to set a cookie via the set-cookie
header.  Since the response has already written the status code and
headers to the browser, this results in an IllegalStateException.

Regards,
Dave