server: access control and credential management centralized with use of session; client: add some desc
save