Make Player entity non-cacheable. Add more session checks to player rest API.