Some fixes. Added controller listener for item composites.
Added AllowAllChecker for DTO access checking.
Some session attributes moved to HTTP session. 
Added session expiration.