* Session now implicitly available to and required by DAO
* Permissions and Roles fleshed out
* withSession directive now required to be implemented for REST routes