Bug: in the past, when the UAF must "resolve" an address (i.e. translate a BrowsePath), it will either 1) re-use an existing Session or 2) create a new one.
The problem is that in the second case, the security settings from the original request were being ignored by the address resolution (i.e. by the Resolver). This is now fixed.

See http://github.com/uaf/uaf/issues/46
added username authentication and some extra info