One project I worked on a few years back required every interaction with the server to first go through a servlet, a validation interface which then hit a required Business Delegate class, a Session ...