Controller REST actions and overrideable session class