I'm thinking specifically in Rails here, but I suspect this is a wider question. In a Rails web application I'm using data from the session in models in order that the models know who is logged in. I use this in a method which filters out some data from the database depending on a very simple permissions system. The thing is: using sessions in…