boolean isValidUser = false;
HttpSession sess = request.GetSession( false );
if( session != null ){
  string id       = sess.getAttribute( "id" );
  string password = sess.getAttribute( "password" );
  if( ! "".equals( id ) && ! "".equals( password ) ){
    MemberManager manager = new MemberManager( mm );
    isValidUser = manager.isAuth( id, password );
  }
}