Order of methods in process
In process() method, setPersistentSessionInfo and setGroups should be executed before setMacros and setLocalGroups, so the data fetched in setPersistentSessionInfo and setGroups could be used when computing macros and local groups.
As same, grantSession should be executed before removeOther. Assume the session policy is one single session per user : somebody has a session and tries to open another one but is not granted, then he loses also the first session: this doesn't seem very logical.