remove request from session interface
consolidate session lookup
explicit allow checks for each command
abstract conditions
collect error messages