Just a wild shot in the dark here, but could it have anything to do with session=false?
posted 8 years ago
For any jsp there are 9 variable which can be used without defining them viz. request, response, session, config, application, out, exception, pageContext. Here request, response and session refers to HttpRequest, HttpResponse and HttpSession. When we set session=false in page directive, it means we can't use session variable as it is. But we can get it exclusively by doing request.getSession() in servlet environment and renderRequest.getPortletSession() in portlet environment.
BTW, I was able to run this piece of code without any error. May the exception you are getting is not related to code.