Rewritten as simple cookie/zsession based authorization