From a coding perspective. I find that using 'Annotations' for security works really well in SPA and is extremely simple. It means that every RPC from the clien

From a coding perspective. I find that using 'Annotations' for security works really well in SPA and is extremely simple. It means that every RPC from the client has authorised checks. I also assume that every unauthenticated request is forbidden, unless I have explicitly annotated the RPC method with anonymous access.