Is there an advantage to using Principle and Indentity objects and attaching them to the context over just storing the user_id in the cookie and having a business object that has methods like InRole() ???

One advantage I see is being able to use a permission attribute on your methods. Any others?

BOb