Open questions from review

1. Do we need to do an audit of other REST methods that might also suffer from this late computation problem?

2. Would not a better fix in this case be to move the session close() boundary so that the session exists when the list is being iterated during marshalling? This presumably has the advantage of not loading every beastie in memory at once. For large instances, a full project list might be an expensive thing memory-wise? maybe not, but if other REST methods that return lists of bigger magnitude suffer similarly, this solution may not scale.

3. Sure the "anonymous user" thing here is a red herring?

4. Why wasn't this picked up by our tests? Can we enhance our tests such to assert correctness now?