Well, SOMETHING has to implement logic to take the parameter from the URL and put it in a session object, then add the session object to the session. So you choice is what.
If you don't want
JSF to create and catalog the session object you essentially either have to code your own
servlet or do it all in
JSP code fragments (I forget the correct name for that - it's a bad thing to do anyway).
It's a lot simpler to set up a session-scope backing bean and let JSF do the work for you.