Those weren't Bear's instructions. Bear said not to put Java code in a JSP.
Things I see that are wrong:
1)
JDBC code in a JSP is incredibly hard to debug
2) The indentation is wrong making it hard to read the code
3) You have a connection leak - the connection needs to be closed in a finally block
4) You have no error handling.
And finally the error you are hitting. Picture the flow of what happens:
request #1
JSP 1 executes the Java code and stores a list in the requestJSP 1 renders the HTML
User clicks go - we now start a new request
request #2
JSP 2 looks in an empty session for a request attribute
In other words, the structure is fundamentally broken.