1.) I don't understand what to say against LoggedInUser extends User and using a subclass in the mapping, for example.
2.) I think wouldn't design it this way. Why don't you take a user which has an additional attribute "loggedIn" (boolean)? Your application then checks whether any user method can be called or not - depending on the attribute "loogedIn".
3.) You're using the wrong DTD with your version of Hibernate. You the following instead:
Code:
<?xml version="1.0"?>
<!DOCTYPE hibernate-mapping PUBLIC
"-//Hibernate/Hibernate Mapping DTD 3.0//EN"
"http://hibernate.sourceforge.net/hibernate-mapping-3.0.dtd">
Best regards
Sven