pass in {req: req} from guards to access control functions, so they
can determine for example if the request came from the client or server
txn.dontPersist - hack for batch set operations
longer bundle timeout (40s)