<p>Does a new <code>SessionFactor</code>y and <code>Session</code> object have to be created for each database? I have a data store for my application data, and a separate data store for my employee security, which is used to validate users. Do I have to create a new SessionFactory ans Session object for calls to the 2 different databases?</p>

ok so this doesn't answer your question directly but it might offer an insight as to why you should create multiple session objects for each datastore.
This article
explains how you can implement a thread safe lazy singleton for each type of Session you need so that you only have one session per datastore but it's shared across the entire application. So at most you're only ever going to have 2 session objects.
To directly answer your question however, you will need 1 session object per database.