Thats where I put it. But hey, it is serializable and can be passed across process boundaries, so you could send it to a remote singleton for later useage. You could save it to disk, i.e. serialization, etc. You could put it into cache, etc.
IMO, there really isnt anything wrong with using session. Thats what its there for. Just be sure to clean up after yourself when you are done.