and another question here: can we explain how the application figures out permissions? do we get the authentication information (e.g. session id) with the request? or does the user need to completely change his application security to use those hashes?