The servlet API has a notion of an HttpSessionEvent and listeners that can receive notifications of sessionCreated and sessionDestroyed events. One can register a Listener via web.xml that implements the HttpSessionListener interface in order to be notified of such events and incorporate them into your application as appropriate.
Because this is configured via a registered Listener in web.xml, it would be potentially useful to add an enhancement to the existing OpenMRS "Listener" class that is already registered, to extend it to implement this interface, and implement this interface by broadcasting sessionCreated and sessionDestroyed events to any registered Components that implement this interface.
This will ultimately allow any module to add an HttpSessionListener implementation, annotated as a @Component, and receive HttpSessionEvent notifications.
My current interest in this is adding additional logging and auditing around user logins, and having the ability to monitor HttpSession create/destroy events will allow detecting when users are logging out vs. having their sessions timeout, etc.