Secure critical parts

[gomezgoiri]

To avoid users from messing up with the webapp, we should avoid them from learning currently opened sessions. This way, they cannot close other users' sessions (using DELETE on the session resource URL).

To do this we should limit the access to the following resources:

• /management/backend.html
• /v1/sessions/

[gomezgoiri]

Alternatives that I am contemplating (in order of complexity and efficacy):

1. Making these resources optional and add them to the webapp or not depending on a configuration property. Afterwards, they will be removed from the webapp to be deployed in the production site.
2. Configure a filter in Tomcat to limit the access to these resources. E.g., allow access only to certain addresses.
3. Implement authorization mechanism in the API. E.g., OAuth.