This new aSession parameter will identify the authentication session of the remote client, or 1 (if authentication mode is not set), or 0 (if the session not started yet).
Service implementation code may then use the new SessionGetUser() protected method to retrieve the session details, e.g. the user logon name and display name, or the associated BLOB data.

This is a code break of existing implementation, but it will provide mandatory additional information for a true Client-Server design.
Next step is to implement a true Interface-based service feature, similar to WCF or SOAP/DataSnap (in my to-do list).

See this link for the corresponding commit.

For instance, here is the difference applied on the corresponding sample folder:

TServiceServer = class(TSQLRestServer)
published
- function Sum(aRecord: TSQLRecord; aParameters: PUTF8Char;
- const aSentData: RawUTF8; var aResp, aHead: RawUTF8): Integer;
+ function Sum(aSession: Cardinal; aRecord: TSQLRecord; aParameters: PUTF8Char;
+ const aSentData: RawUTF8; out aResp, aHead: RawUTF8): Integer;
end;

Note that the callback prototype changed again, for simplicity and to avoid most further change.