security session data stored outside identity, $request param in authenticate()
schema: affiliations table, support for password reset
security service: context, token and impersonation moved to $_SESSION (Zend_Session_Namespace would be a bit overkill here)