/ws secured jaxrs endpoints are too eagerly logging in JCR (user) sessions

At this moment, the /ws jaxrs support in the repository has support for ManagedUserSessionInvoker which takes care of providing a logged in jcr user session (and system session) for every request.

System sessions in general are quite cheap to login. A user session however can be expensive for multiple reasons

1) When there are very many domain rules, logging in a jcr session becomes more expensive due to a possibly complex authorization query
2) When there is external authentication, for example via LDAP, a login can take some more time

Our CMS application is a stateful app requiring sticky http sessions. We should not need to login so many fresh new jcr session.

There is no problem with having for example a separate jcr session for the wicket code and a separate one for the jaxrs invocations, as long as it does not use a jcr session per request.