Firstly don't use outjection in application scoped components, it is not threadsafe. Use Contexts.getSessionContext().put() instead.
As Pete said if you inherit from org.jboss.seam.web.ContextFilter you will have access to the session context inside the filter, however this is normally used to provide the contexts to an external servlet, not to start the seam lifecycle earlier than usual. I am almost certain this will give you errors when seam tries to end its lifecycle twice (at a guess line 368 of Manager.java) but it may be worth a try.
the simple solution is to use
session.setAttribute("user",user)