anchor.diff:  
   resource_exists(Req, #state{id=undefined} = State) ->
       {true, Req, State};
  -resource_exists(Req, #state{type=oidcp, id=Id} = State) ->
  -    case oidcc:get_openid_provider_info(Id) of
  -        {ok, Info} ->
  -            {true, Req, State#state{object = Info}};
  -        _ -> {false, Req, State}
  -    end;
  -resource_exists(Req, #state{type=service, id=Id} = State) ->
  -    case tts_service:get_info(Id) of
  -        {ok, Info} ->
  -            {true, Req, State#state{object = Info}};
  -        _ -> {false, Req, State}
  -    end;
  -resource_exists(Req, #state{type=credential, id=Id,
  -                            user_info=#{site := #{uid :=UserId}}}=State) ->
  -    Result = tts_credential:exists(UserId, Id),
  -    {Result, Req, State};
  +resource_exists(Req, #state{type=oidcp, id=Id, session_pid=Session} = State) ->
  +    Exists = tts:does_provider_exist(Id, Session),
  +    {Exists, Req, State};
  +resource_exists(Req, #state{type=service, id=Id, session_pid=Session}
  +                = State) ->
  +    Exists = tts:does_service_exist(Id, Session),
  +    {Exists, Req, State};
  +resource_exists(Req, #state{type=credential, id=Id, session_pid=Session}
  +                = State) ->
  +    Exists = tts:does_credential_exist(Id, Session),
  +    {Exists, Req, State};
   resource_exists(Req, #state{type=cred_data}=State) ->
       {true, Req, State};
   resource_exists(Req, State) ->
       {false, Req, State}.
   
   delete_resource(Req, #state{type=credential,
  -                            id=CredentialId, user_info=UserInfo}=State) ->
  -     case tts_credential:revoke(CredentialId, UserInfo) of
  -         {ok, _, _} -> {true, Req, State};
  -         _ -> {false, Req, State}
  -     end.
  +                            id=CredentialId, session_pid=Session}=State) ->
  +    Result = case tts:revoke_credential_for(CredentialId, Session) of
  +                 {ok, _, _} -> true;
  +                 _ -> false
  +             end,
  +    ok = tts:logout(Session),
  +    {Result, Req, State#state{session_pid=undefined}}.
   
   
   get_json(Req, #state{version=Version, type=Type, id=Id, method=get,
  -                     object=Object, user_info=UserInfo } = State) ->
  -    Result = perform_get(Type, Id, Object, UserInfo, Version),
  -    {Result, Req, State}.
  +                     session_pid=Session } = State) ->
  +    Result = perform_get(Type, Id, Session, Version),
  +    ok = tts:logout(Session),
  +    {Result, Req, State#state{session_pid=undefined}}.
   
   
   post_json(Req, #state{version=Version, type=Type, id=Id, method=post,
  -                      user_info=UserInfo, json=Json} = State) ->
  -    Result = perform_post(Type, Id, Json, UserInfo, Version),
  -    {Result, Req, State}.
  -
  -perform_get(service, undefined, _, #{ site := #{uid:=UserId}}, _Version) ->
  -    {ok, ServiceList} = tts_service:get_list(UserId),
  -    return_service_list(ServiceList);
  -perform_get(oidcp, undefined, _, _, _Version) ->
  -    {ok, OIDCList} = oidcc:get_openid_provider_list(),
  -    return_oidc_list(OIDCList);
  -perform_get(credential, undefined, _, #{ site := #{uid := UserId}}, _Version) ->
  -    {ok, CredList} = tts_credential:get_list(UserId),
  -    return_credential_list(CredList);
  -perform_get(cred_data, Id, _, #{ site := #{uid := UserId}}, _Version) ->
  -    case tts_rest_cred:get_cred(Id, UserId) of
  +                      session_pid=Session, json=Json} = State) ->
  +    Result = perform_post(Type, Id, Json, Session, Version),
  +    ok = tts:logout(Session),
  +    {Result, Req, State#state{session_pid=undefined}}.
  +
  +perform_get(service, undefined, Session, _Version) ->
  +    {ok, ServiceList} = tts:get_service_list_for(Session),
  +    return_json_service_list(ServiceList);
  +perform_get(oidcp, undefined, _, _Version) ->
  +    {ok, OIDCList} = tts:get_openid_provider_list(),
  +    return_json_oidc_list(OIDCList);
  +perform_get(credential, undefined, Session, _Version) ->
  +    {ok, CredList} = tts:get_credential_list_for(Session),
  +    return_json_credential_list(CredList);
  +perform_get(cred_data, Id, Session, _Version) ->
  +    case tts:get_temp_cred(Id, Session) of
           {ok, Cred} -> jsx:encode(Cred);
           _ -> jsx:encode(#{})
       end.
   
  -perform_post(credential, undefined, #{service_id:=ServiceId}, UserInfo, Ver) ->
  +perform_post(credential, undefined, #{service_id:=ServiceId}, Session, Ver) ->
       IFace = <<"REST interface">>,
  -    case  tts_credential:request(ServiceId, UserInfo, IFace, rest, []) of
  +    case  tts:request_credential_for(ServiceId, Session, [], IFace) of
           {ok, Credential, _Log} ->
  -            #{ site := #{ uid := UserId }} = UserInfo,
  -            {ok, Id} = tts_rest_cred:add_cred(Credential, UserId),
  +            {ok, Id} = tts:store_temp_cred(Credential, Session),
               Url = id_to_url(Id, Ver),
               {true, Url};
           _ ->
               false
       end.
   
  -return_service_list(Services) ->
  +return_json_service_list(Services) ->
       Extract = fun(Map, List) ->
                         Keys = [id, type, host, port],
                         [ maps:with(Keys, Map) | List]
  
positive.code:     List = lists:reverse(lists:foldl(Extract, [], Services)),
      jsx:encode(#{service_list => List}).
  
  return_oidc_list(Oidc) ->
      Id = fun({OidcId, Pid}, List) ->
                   Result = oidcc:get_openid_provider_info(Pid),
                   case Result of
                   {ok, #{issuer := Issuer, ready := true}}  ->
                           [#{ id => OidcId, issuer => Issuer} | List];
                       _ -> List
                   end
           end,
      List = lists:reverse(lists:foldl(Id, [], Oidc)),
      jsx:encode(#{openid_provider_list => List}).
  
  return_credential_list(Credentials) ->
      Id = fun(CredId, List) ->
                   [#{ id => CredId} | List]
           end,
  
negative.code:    (Version =< 0) or (Version > ?LATEST_VERSION);
  is_bad_version(_) ->
      true.
  