massive update:

1) new IXSI version with consumption transfer and bookingunlock feature required adding more dispatching decisions and processors
2) there can be a list of userInfos now. to deal with that, validating and processing are pushed down to processors
3) removed user response params. the idea is: if we decide to use session-based auth in future, this can be done globally (in dispatchers?) rather than in processors