session variables are shared between different sessions

J2EE web applications using XSL and XML, and apache's tag libs running on Jboss v3.2.2 and v3.2.3 or Tomcat 5 share session variables between different sessions.
ie. if we have 2 users, user A and user B browsing the app at the same time, but each is in a different location, user A can see the data that user B entered in page 1 when user B is in page 2 (when the data is saved in the session), and user A refreshes page 1.

This problem doesn't occur whith the same J2EE app using the same tag libs runing on sun one app server.

This problem doesn't happen either if the deployed application is not using XSL and XML.

NOTE
This application gives errors during deployment when deployed on any later JBoss AS version.(although i'm using the latest release of apache's tab libs)