First of all, a question: I didn't see an obvious way to interrupt and check for permissions when clients make a request. Method validations look good but where do I get the session to check? Well, other than this, it really looks great. Looking forward to further development. Best luck to the author.