Essentially, you install it on both the request and response chains of your service, on both the client and the server side.

ON THE SERVER:

• The REQUEST is checked for a session ID header. If present, we look up the correct SimpleSession. If not, we create a new session. In either case, we install the session into the MessageContext, and put its ID in the SESSION_ID property.
• The RESPONSE gets a session ID header tacked on, assuming we found a SESSION_ID property in the MessageContext.

ON THE CLIENT:

• The RESPONSE messages are checked for session ID headers. If present, we pull the ID out and insert it into an option in the AxisClient. This works because a given Call object is associated with a single AxisClient. However, we might want to find a way to put it into the Call object itself, which would make a little more sense. This would mean being able to get to the Call from the MC, i.e. adding a getCall() API (which would only work on the client side)....
• When REQUESTS are generated, we look to see if an ID option is present in the AxisClient associated with the MessageContext. If so, we insert a session ID header with the appropriate ID.

SimpleSessions are "reaped" periodically via a very simplistic mechanism. Each time the handler is invoke()d we check to see if more than reapPeriodicity milliseconds have elapsed since the last reap. If so, we walk the collection of active Sessions, and for each one, if it hasn't been "touched" (i.e. had a getProperty() or setProperty() performed) in longer than its timeout, we remove it from the collection.