Thanks for posting your replies and solutions. Haven’t checked them yet, but it looks like they should really work. And it’s definitely worth small chapter in Docs, describing potential issues and workarounds. It’ll really help pretty newcomers to plan and develop their pretty web apps, having big picture in the very beginning and avoiding future redesign. Like in my case
I will post here my final solution for JSR-315 based security, most probably based on the one proposed by domdorn.
Do you play Magic?
Get TopDecked MTG, the #1 Magic App, built by players, for players. Free to use, forever.