I think I asked you this in an earlier thread. I'm thinking about security again, and it seems to me that the
best idea is to validate user access at the database level via username and password.

What if I created a user class which stores user info (name, username, password, access info) upon login and
is returned serialized to the client?

The user object could be then passed around at the client level and also to each method on the WS,
which could use the information stored on it to validate the user on each subsequent call.