Hi Nick,
Your question is extremely related with your architecture and your goals. Drools and jBPM5 are flexible enough to let you decide how many sessions do you want to have and how to handle them. If you want to start a business process per request and you have long running processes (that means that you will need to configure persistence) you can have one session per process instance. As you mention creating a knowledge session is cheap enough to do it per request, but you need to analyze how many request are you getting in your application and what's the scope of the business process. Most of the time if your process solve a business situation you will not have troubles with creating one session per request, becase at business level it is not common to recieve too many business request together.
About calling the dispose() method, you need to do that every time that your process reaches a wait state if you are using persistence, to make sure that you free up all the resources and anoher thread will reload the session from the DB with a coherent status.
Cheers