+ added SESSION.USER -var
+ added RoleHandler
! generalised url-finding to obj-handler
! bugfix NPE