Yes, the good old HttpSession can play havoc with your entities.
Basically, the problem is that you have two JavaBean instances that represent the same data. One is loaded, I'm guessing by Hibernate, then you put it into the HttpSession, you pull it out of the HttpSession, at which point it is given a new memory location on the JVM, and as such, Hibernate thinks the object is different from the one pulled out of the HibernateSession. When you go to save the one pulled out of the HttpSession, Hibernate thinks its a different object pointing at the same data, and it gets upset.
One way to avoid this might be to override the .equals and .hashcode methods. A better way?
Just put the primary key of the object in the HttpSession, rather than the object. Then, when you need the object, pull it out of the Hibernate Session and update the values of the object as necessary. Not only will this eliminate Session bloat and take advantage of the POJO cached in the Hibernate Session's first level cache.
Take a look at this tutorial on How Hibernate3 Works for more information on persistent objects, detached objects and the NonUniqueObject Exception that you are getting.
http://www.hiberbook.com/HiberBookWeb/learn.jsp?tutorial=07howhibernateworks