蛋疼的j2ee空指针异常

最近完成一个j2ee的网站项目，  遇到了下面这个问题

写一个登录类，保存登录用户的session 用户， 密码

package com.tyland.action;

import java.sql.Array;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;

import org.hibernate.Query;
import org.hibernate.SessionFactory;
import org.hibernate.classic.Session;
import com.opensymphony.xwork2.ActionSupport;
import com.tyland.domain.AccountType;
import com.tyland.dao.AccountTypeDao;
import org.springframework.orm.hibernate3.support.HibernateDaoSupport;


public class LoginAction extends ActionSupport
{
     /**
     *   gdcc  登陆页面逻辑
     */
    
    
    private static final long serialVersionUID = 1059318446535409471L;
    private String password;
    private SessionFactory  sessionFactory;
    private String username;
    private Map<String, Object> session;
    private AccountType  loginUser;
    private AccountTypeDao   accountTypeDao;
    
    public AccountType getLoginUser() {
        return loginUser;
    }

    public void setLoginUser(AccountType loginUser) {
        this.loginUser = loginUser;
    }

    public Map<String, Object> getSession() {
        return session;
    }

    public void setSession(Map<String, Object> session) {
        this.session = session;
    }

    public SessionFactory getSessionFactory() {
            return sessionFactory;
            }
     
     public void setSessionFactory(SessionFactory sessionFactory) {
            this.sessionFactory = sessionFactory;
            }
        
     public String getPassword() {
        return password;
    }
    public void setPassword(String password) {
        this.password = password;
    }
    public String getUsername() {
        return username;
    }
    public void setUsername(String username) {
        this.username = username;
    }

     public String execute() throws Exception
     {     
         return "loginsucess";          
         
     }
public String  login ()throws Exception
 {
     /**
      * 
      *   不使用spring框架来进行登陆页面的注册
      */
     Session session1 =  sessionFactory.openSession();
     
     String hql = "from AccountType u where u.username=? and u.password=?";
     Query query = session1.createQuery(hql);
     query.setParameter(0, username);
     query.setParameter(1, password);
     System.out.println(username);
     System.out.println(password);
     List   user = query.list();
     
//     loginUser.setUsername("1221")；                                          
//    loginUser.setId(11111);
//     loginUser.setPassword("sdadsadas");
//调这个函数出现空指针异常
     
     this.loginUser =  this.accountTypeDao.startlogin(username, password);
         
     this.session.put("sessionUser", this.loginUser);
     if(user.size()>0)
     {  
        
         session1.close();
         return "loginsucess";  
     }
     else
     {
      return "logout";
     }
 }

}

 注释部分的空指针异常，非常奇怪！纠结！！！！