Question: Is it bad design to make your business(service) layer dependant on a user session?