prevented Session.save() when RepositoryExceptions are thrown (was in finally block)
turned down logging of access control exceptions (ERROR => DEBUG)
made all REST API sessions, with or without client login, use ServletCredentials to obtain a ModeShape session
this is so that we can use the same PEP injection for anonymous clients as we do for logged in users.