query constraints (eg, ....?recursive=true&q:foo=bar
a lot of 'role' and app bits plumbing
SSO hackery