secutiry interceptor, http service for managing session attrs, first unit tests