Hi Tom.
This is one of the most popular controversy available on the Hibernate usage: where to open and where to close your sessions. AND, if you're working with a web-based MVC, there's even more to consider.
The fact is that you should close your session after using it in a way or another, sessions holds connections, transactions, cached objects, and lots of features and those are managed when you open and close it.
I'm working heavily with Hibernate on a project right now. We have adopted an approach where my DAO factory has no idea of there it's session came from, it's constructor injected by it's caller. This solves part of the problem.
Also, we're using an MVC framework called VRaptor (
http://www.vraptor.org/) that comes with some solutions that allows you to delegate the session's opening and closing to interceptors. It gives you freedom to transparently handle lazy lists and attributes on your jsp's...
Is that any help? Hope so!
Regards