Work update

SADictionary made more virtual
Permissions for request now defined in SARequestHandler
Removed legacy session support from request handlers
Session support now uses hybrid token/cookie protocol
SAResource handler still in developent