diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 1bcdb7f54a9..d82f4a85775 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -35,9 +35,8 @@ from openerp.tools.translate import _
 from openerp.tools import config
 
 from .. import http
-openerpweb = http
 
-from openerp.addons.web.http import request as req
+from openerp.addons.web.http import request
 
 #----------------------------------------------------------
 # OpenERP Web helpers
@@ -87,50 +86,29 @@ def rjsmin(script):
     ).strip()
     return result
 
-def db_list(force=False):
-    proxy = req.session.proxy("db")
-    dbs = proxy.list(force)
-    h = req.httprequest.environ['HTTP_HOST'].split(':')[0]
-    d = h.split('.')[0]
-    r = openerp.tools.config['dbfilter'].replace('%h', h).replace('%d', d)
-    dbs = [i for i in dbs if re.match(r, i)]
-    return dbs
+db_list = http.db_list
 
 def db_monodb_redirect():
-    db = False
-    redirect = False
+    db = db_monodb()
 
-    # 1 try the db in the url
-    db_url = req.params.get('db')
-    if db_url:
-        return (db_url, False)
+    if request.params.get('db'):
+        return (db, False)
 
     dbs = db_list(True)
-
-    # 2 use the database from the cookie if it's listable and still listed
-    cookie_db = req.httprequest.cookies.get('last_used_database')
-    if cookie_db in dbs:
-        db = cookie_db
-
-    # 3 use the first db if user can list databases
-    if dbs and not db and (config['list_db'] or len(dbs) == 1):
-        db = dbs[0]
-
     # redirect to the chosen db if multiple are available
+    redirect = False
     if db and len(dbs) > 1:
-        query = dict(urlparse.parse_qsl(req.httprequest.query_string, keep_blank_values=True))
-        query.update({'db': db})
-        redirect = req.httprequest.path + '?' + urllib.urlencode(query)
+        query = dict(urlparse.parse_qsl(request.httprequest.query_string, keep_blank_values=True))
+        query.update({ 'db': db })
+        redirect = request.httprequest.path + '?' + urllib.urlencode(query)
     return (db, redirect)
 
-def db_monodb():
-    # if only one db exists, return it else return False
-    return db_monodb_redirect()[0]
+db_monodb = http.db_monodb
 
 def redirect_with_hash(url, code=303):
-    if req.httprequest.user_agent.browser == 'msie':
+    if request.httprequest.user_agent.browser == 'msie':
         try:
-            version = float(req.httprequest.user_agent.version)
+            version = float(request.httprequest.user_agent.version)
             if version < 10:
                 return "<html><head><script>window.location = '%s#' + location.hash;</script></head></html>" % url
         except Exception:
@@ -183,18 +161,18 @@ def module_topological_sort(modules):
 
 def module_installed():
     # Candidates module the current heuristic is the /static dir
-    loadable = openerpweb.addons_manifest.keys()
+    loadable = http.addons_manifest.keys()
     modules = {}
 
     # Retrieve database installed modules
     # TODO The following code should move to ir.module.module.list_installed_modules()
-    Modules = req.session.model('ir.module.module')
+    Modules = request.session.model('ir.module.module')
     domain = [('state','=','installed'), ('name','in', loadable)]
     for module in Modules.search_read(domain, ['name', 'dependencies_id']):
         modules[module['name']] = []
         deps = module.get('dependencies_id')
         if deps:
-            deps_read = req.session.model('ir.module.module.dependency').read(deps, ['name'])
+            deps_read = request.session.model('ir.module.module.dependency').read(deps, ['name'])
             dependencies = [i['name'] for i in deps_read]
             modules[module['name']] = dependencies
 
@@ -202,7 +180,7 @@ def module_installed():
     return sorted_modules
 
 def module_installed_bypass_session(dbname):
-    loadable = openerpweb.addons_manifest.keys()
+    loadable = http.addons_manifest.keys()
     modules = {}
     try:
         registry = openerp.modules.registry.RegistryManager.get(dbname)
@@ -228,7 +206,7 @@ def module_boot(db=None):
     serverside = []
     dbside = []
     for i in server_wide_modules:
-        if i in openerpweb.addons_manifest:
+        if i in http.addons_manifest:
             serverside.append(i)
     monodb = db or db_monodb()
     if monodb:
@@ -315,7 +293,7 @@ def manifest_glob(extension, addons=None, db=None, include_remotes=False):
         addons = addons.split(',')
     r = []
     for addon in addons:
-        manifest = openerpweb.addons_manifest.get(addon, None)
+        manifest = http.addons_manifest.get(addon, None)
         if not manifest:
             continue
         # ensure does not ends with /
@@ -336,7 +314,7 @@ def manifest_list(extension, mods=None, db=None):
     db: a database name (return all installed modules in that database)
     """
     files = manifest_glob(extension, addons=mods, db=db, include_remotes=True)
-    if not req.debug:
+    if not request.debug:
         path = '/web/webclient/' + extension
         if mods is not None:
             path += '?' + urllib.urlencode({'mods': mods})
@@ -381,28 +359,28 @@ def make_conditional(response, last_modified=None, etag=None):
         response.last_modified = last_modified
     if etag:
         response.set_etag(etag)
-    return response.make_conditional(req.httprequest)
+    return response.make_conditional(request.httprequest)
 
 def login_and_redirect(db, login, key, redirect_url='/'):
-    wsgienv = req.httprequest.environ
+    wsgienv = request.httprequest.environ
     env = dict(
-        base_location=req.httprequest.url_root.rstrip('/'),
+        base_location=request.httprequest.url_root.rstrip('/'),
         HTTP_HOST=wsgienv['HTTP_HOST'],
         REMOTE_ADDR=wsgienv['REMOTE_ADDR'],
     )
-    req.session.authenticate(db, login, key, env)
+    request.session.authenticate(db, login, key, env)
     return set_cookie_and_redirect(redirect_url)
 
 def set_cookie_and_redirect(redirect_url):
     redirect = werkzeug.utils.redirect(redirect_url, 303)
     redirect.autocorrect_location_header = False
-    cookie_val = urllib2.quote(simplejson.dumps(req.session_id))
+    cookie_val = urllib2.quote(simplejson.dumps(request.session_id))
     redirect.set_cookie('instance0|session_id', cookie_val)
     return redirect
 
 def load_actions_from_ir_values(key, key2, models, meta):
-    Values = req.session.model('ir.values')
-    actions = Values.get(key, key2, models, meta, req.context)
+    Values = request.session.model('ir.values')
+    actions = Values.get(key, key2, models, meta, request.context)
 
     return [(id, name, clean_action(action))
             for id, name, action in actions]
@@ -528,8 +506,8 @@ def xml2json_from_elementtree(el, preserve_whitespaces=False):
 def content_disposition(filename):
     filename = filename.encode('utf8')
     escaped = urllib2.quote(filename)
-    browser = req.httprequest.user_agent.browser
-    version = int((req.httprequest.user_agent.version or '0').split('.')[0])
+    browser = request.httprequest.user_agent.browser
+    version = int((request.httprequest.user_agent.version or '0').split('.')[0])
     if browser == 'msie' and version < 9:
         return "attachment; filename=%s" % escaped
     elif browser == 'safari':
@@ -568,10 +546,9 @@ html_template = """<!DOCTYPE html>
 </html>
 """
 
-class Home(openerpweb.Controller):
-    _cp_path = '/'
+class Home(http.Controller):
 
-    @openerpweb.httprequest
+    @http.route('/', type='http', auth="none")
     def index(self, s_action=None, db=None, **kw):
         db, redir = db_monodb_redirect()
         if redir:
@@ -588,35 +565,29 @@ class Home(openerpweb.Controller):
         }
         return r
 
-    @openerpweb.httprequest
+    @http.route('/login', type='http', auth="user")
     def login(self, db, login, key):
         return login_and_redirect(db, login, key)
 
-    @openerpweb.jsonrequest
-    def jsonrpc(self, service, method, args):
-        """ Method used by client APIs to contact OpenERP. """
-        return getattr(req.session.proxy(service), method)(*args)
+class WebClient(http.Controller):
 
-class WebClient(openerpweb.Controller):
-    _cp_path = "/web/webclient"
-
-    @openerpweb.jsonrequest
+    @http.route('/web/webclient/csslist', type='json', auth="none")
     def csslist(self, mods=None):
         return manifest_list('css', mods=mods)
 
-    @openerpweb.jsonrequest
+    @http.route('/web/webclient/jslist', type='json', auth="none")
     def jslist(self, mods=None):
         return manifest_list('js', mods=mods)
 
-    @openerpweb.jsonrequest
+    @http.route('/web/webclient/qweblist', type='json', auth="none")
     def qweblist(self, mods=None):
         return manifest_list('qweb', mods=mods)
 
-    @openerpweb.httprequest
+    @http.route('/web/webclient/css', type='http', auth="none")
     def css(self, mods=None, db=None):
         files = list(manifest_glob('css', addons=mods, db=db))
         last_modified = get_last_modified(f[0] for f in files)
-        if req.httprequest.if_modified_since and req.httprequest.if_modified_since >= last_modified:
+        if request.httprequest.if_modified_since and request.httprequest.if_modified_since >= last_modified:
             return werkzeug.wrappers.Response(status=304)
 
         file_map = dict(files)
@@ -660,36 +631,36 @@ class WebClient(openerpweb.Controller):
         content = '\n'.join(matches)
 
         return make_conditional(
-            req.make_response(content, [('Content-Type', 'text/css')]),
+            request.make_response(content, [('Content-Type', 'text/css')]),
             last_modified, checksum)
 
-    @openerpweb.httprequest
+    @http.route('/web/webclient/js', type='http', auth="none")
     def js(self, mods=None, db=None):
         files = [f[0] for f in manifest_glob('js', addons=mods, db=db)]
         last_modified = get_last_modified(files)
-        if req.httprequest.if_modified_since and req.httprequest.if_modified_since >= last_modified:
+        if request.httprequest.if_modified_since and request.httprequest.if_modified_since >= last_modified:
             return werkzeug.wrappers.Response(status=304)
 
         content, checksum = concat_js(files)
 
         return make_conditional(
-            req.make_response(content, [('Content-Type', 'application/javascript')]),
+            request.make_response(content, [('Content-Type', 'application/javascript')]),
             last_modified, checksum)
 
-    @openerpweb.httprequest
+    @http.route('/web/webclient/qweb', type='http', auth="none")
     def qweb(self, mods=None, db=None):
         files = [f[0] for f in manifest_glob('qweb', addons=mods, db=db)]
         last_modified = get_last_modified(files)
-        if req.httprequest.if_modified_since and req.httprequest.if_modified_since >= last_modified:
+        if request.httprequest.if_modified_since and request.httprequest.if_modified_since >= last_modified:
             return werkzeug.wrappers.Response(status=304)
 
         content, checksum = concat_xml(files)
 
         return make_conditional(
-            req.make_response(content, [('Content-Type', 'text/xml')]),
+            request.make_response(content, [('Content-Type', 'text/xml')]),
             last_modified, checksum)
 
-    @openerpweb.jsonrequest
+    @http.route('/web/webclient/bootstrap_translations', type='json', auth="none")
     def bootstrap_translations(self, mods):
         """ Load local translations from *.po files, as a temporary solution
             until we have established a valid session. This is meant only
@@ -698,12 +669,12 @@ class WebClient(openerpweb.Controller):
         # For performance reasons we only load a single translation, so for
         # sub-languages (that should only be partially translated) we load the
         # main language PO instead - that should be enough for the login screen.
-        lang = req.lang.split('_')[0]
+        lang = request.lang.split('_')[0]
 
         translations_per_module = {}
         for addon_name in mods:
-            if openerpweb.addons_manifest[addon_name].get('bootstrap'):
-                addons_path = openerpweb.addons_manifest[addon_name]['addons_path']
+            if http.addons_manifest[addon_name].get('bootstrap'):
+                addons_path = http.addons_manifest[addon_name]['addons_path']
                 f_name = os.path.join(addons_path, addon_name, "i18n", lang + ".po")
                 if not os.path.exists(f_name):
                     continue
@@ -712,9 +683,9 @@ class WebClient(openerpweb.Controller):
         return {"modules": translations_per_module,
                 "lang_parameters": None}
 
-    @openerpweb.jsonrequest
+    @http.route('/web/webclient/translations', type='json', auth="user")
     def translations(self, mods, lang):
-        res_lang = req.session.model('res.lang')
+        res_lang = request.session.model('res.lang')
         ids = res_lang.search([("code", "=", lang)])
         lang_params = None
         if ids:
@@ -723,7 +694,7 @@ class WebClient(openerpweb.Controller):
 
         # Regional languages (ll_CC) must inherit/override their parent lang (ll), but this is
         # done server-side when the language is loaded, so we only need to load the user's lang.
-        ir_translation = req.session.model('ir.translation')
+        ir_translation = request.session.model('ir.translation')
         translations_per_module = {}
         messages = ir_translation.search_read([('module','in',mods),('lang','=',lang),
                                                ('comments','like','openerp-web'),('value','!=',False),
@@ -737,14 +708,13 @@ class WebClient(openerpweb.Controller):
         return {"modules": translations_per_module,
                 "lang_parameters": lang_params}
 
-    @openerpweb.jsonrequest
+    @http.route('/web/webclient/version_info', type='json', auth="none")
     def version_info(self):
         return openerp.service.common.exp_version()
 
-class Proxy(openerpweb.Controller):
-    _cp_path = '/web/proxy'
+class Proxy(http.Controller):
 
-    @openerpweb.jsonrequest
+    @http.route('/web/proxy/load', type='json', auth="none")
     def load(self, path):
         """ Proxies an HTTP request through a JSON request.
 
@@ -757,12 +727,11 @@ class Proxy(openerpweb.Controller):
         from werkzeug.test import Client
         from werkzeug.wrappers import BaseResponse
 
-        return Client(req.httprequest.app, BaseResponse).get(path).data
+        return Client(request.httprequest.app, BaseResponse).get(path).data
 
-class Database(openerpweb.Controller):
-    _cp_path = "/web/database"
+class Database(http.Controller):
 
-    @openerpweb.jsonrequest
+    @http.route('/web/database/get_list', type='json', auth="none")
     def get_list(self):
         # TODO change js to avoid calling this method if in monodb mode
         try:
@@ -773,17 +742,17 @@ class Database(openerpweb.Controller):
                 return [monodb]
             raise
 
-    @openerpweb.jsonrequest
+    @http.route('/web/database/create', type='json', auth="none")
     def create(self, fields):
         params = dict(map(operator.itemgetter('name', 'value'), fields))
-        return req.session.proxy("db").create_database(
+        return request.session.proxy("db").create_database(
             params['super_admin_pwd'],
             params['db_name'],
             bool(params.get('demo_data')),
             params['db_lang'],
             params['create_admin_pwd'])
 
-    @openerpweb.jsonrequest
+    @http.route('/web/database/duplicate', type='json', auth="none")
     def duplicate(self, fields):
         params = dict(map(operator.itemgetter('name', 'value'), fields))
         duplicate_attrs = (
@@ -791,32 +760,36 @@ class Database(openerpweb.Controller):
             params['db_original_name'],
             params['db_name'],
         )
-        return req.session.proxy("db").duplicate_database(*duplicate_attrs)
 
-    @openerpweb.jsonrequest
+        return request.session.proxy("db").duplicate_database(*duplicate_attrs)
+
+    @http.route('/web/database/drop', type='json', auth="none")
     def drop(self, fields):
         password, db = operator.itemgetter(
             'drop_pwd', 'drop_db')(
                 dict(map(operator.itemgetter('name', 'value'), fields)))
         
         try:
-            if req.session.proxy("db").drop(password, db):return True
+            if request.session.proxy("db").drop(password, db):
+                return True
+            else:
+                return False
         except openerp.exceptions.AccessDenied:
             return {'error': 'AccessDenied', 'title': 'Drop Database'}
         except Exception:
             return {'error': _('Could not drop database !'), 'title': _('Drop Database')}
 
-    @openerpweb.httprequest
+    @http.route('/web/database/backup', type='http', auth="none")
     def backup(self, backup_db, backup_pwd, token):
         try:
             db_dump = base64.b64decode(
-                req.session.proxy("db").dump(backup_pwd, backup_db))
+                request.session.proxy("db").dump(backup_pwd, backup_db))
             filename = "%(db)s_%(timestamp)s.dump" % {
                 'db': backup_db,
                 'timestamp': datetime.datetime.utcnow().strftime(
                     "%Y-%m-%d_%H-%M-%SZ")
             }
-            return req.make_response(db_dump,
+            return request.make_response(db_dump,
                [('Content-Type', 'application/octet-stream; charset=binary'),
                ('Content-Disposition', content_disposition(filename))],
                {'fileToken': int(token)}
@@ -824,58 +797,59 @@ class Database(openerpweb.Controller):
         except Exception, e:
             return simplejson.dumps([[],[{'error': openerp.tools.ustr(e), 'title': _('Backup Database')}]])
 
-    @openerpweb.httprequest
+    @http.route('/web/database/restore', type='http', auth="none")
     def restore(self, db_file, restore_pwd, new_db):
         try:
             data = base64.b64encode(db_file.read())
-            req.session.proxy("db").restore(restore_pwd, new_db, data)
+            request.session.proxy("db").restore(restore_pwd, new_db, data)
             return ''
         except openerp.exceptions.AccessDenied, e:
             raise Exception("AccessDenied")
 
-    @openerpweb.jsonrequest
+    @http.route('/web/database/change_password', type='json', auth="none")
     def change_password(self, fields):
         old_password, new_password = operator.itemgetter(
             'old_pwd', 'new_pwd')(
                 dict(map(operator.itemgetter('name', 'value'), fields)))
         try:
-            return req.session.proxy("db").change_admin_password(old_password, new_password)
+            return request.session.proxy("db").change_admin_password(old_password, new_password)
         except openerp.exceptions.AccessDenied:
             return {'error': 'AccessDenied', 'title': _('Change Password')}
         except Exception:
             return {'error': _('Error, password not changed !'), 'title': _('Change Password')}
 
-class Session(openerpweb.Controller):
-    _cp_path = "/web/session"
+class Session(http.Controller):
 
     def session_info(self):
-        req.session.ensure_valid()
+        request.session.ensure_valid()
         return {
-            "session_id": req.session_id,
-            "uid": req.session._uid,
-            "user_context": req.session.get_context() if req.session._uid else {},
-            "db": req.session._db,
-            "username": req.session._login,
+            "session_id": request.session_id,
+            "uid": request.session._uid,
+            "user_context": request.session.get_context() if request.session._uid else {},
+            "db": request.session._db,
+            "username": request.session._login,
         }
 
-    @openerpweb.jsonrequest
+    @http.route('/web/session/get_session_info', type='json', auth="none")
     def get_session_info(self):
+        request.uid = request.session._uid
+        request.db = request.session._db
         return self.session_info()
 
-    @openerpweb.jsonrequest
+    @http.route('/web/session/authenticate', type='json', auth="none")
     def authenticate(self, db, login, password, base_location=None):
-        wsgienv = req.httprequest.environ
+        wsgienv = request.httprequest.environ
         env = dict(
             base_location=base_location,
             HTTP_HOST=wsgienv['HTTP_HOST'],
             REMOTE_ADDR=wsgienv['REMOTE_ADDR'],
         )
-        req.session.authenticate(db, login, password, env)
+        request.session.authenticate(db, login, password, env)
 
         return self.session_info()
 
-    @openerpweb.jsonrequest
-    def change_password (self, fields):
+    @http.route('/web/session/change_password', type='json', auth="user")
+    def change_password(self, fields):
         old_password, new_password,confirm_password = operator.itemgetter('old_pwd', 'new_password','confirm_pwd')(
                 dict(map(operator.itemgetter('name', 'value'), fields)))
         if not (old_password.strip() and new_password.strip() and confirm_password.strip()):
@@ -883,31 +857,31 @@ class Session(openerpweb.Controller):
         if new_password != confirm_password:
             return {'error': _('The new password and its confirmation must be identical.'),'title': _('Change Password')}
         try:
-            if req.session.model('res.users').change_password(
+            if request.session.model('res.users').change_password(
                 old_password, new_password):
                 return {'new_password':new_password}
         except Exception:
             return {'error': _('The old password you provided is incorrect, your password was not changed.'), 'title': _('Change Password')}
         return {'error': _('Error, password not changed !'), 'title': _('Change Password')}
 
-    @openerpweb.jsonrequest
+    @http.route('/web/session/sc_list', type='json', auth="user")
     def sc_list(self):
-        return req.session.model('ir.ui.view_sc').get_sc(
-            req.session._uid, "ir.ui.menu", req.context)
+        return request.session.model('ir.ui.view_sc').get_sc(
+            request.session._uid, "ir.ui.menu", request.context)
 
-    @openerpweb.jsonrequest
+    @http.route('/web/session/get_lang_list', type='json', auth="none")
     def get_lang_list(self):
         try:
-            return req.session.proxy("db").list_lang() or []
+            return request.session.proxy("db").list_lang() or []
         except Exception, e:
             return {"error": e, "title": _("Languages")}
 
-    @openerpweb.jsonrequest
+    @http.route('/web/session/modules', type='json', auth="user")
     def modules(self):
         # return all installed modules. Web client is smart enough to not load a module twice
         return module_installed()
 
-    @openerpweb.jsonrequest
+    @http.route('/web/session/save_session_action', type='json', auth="user")
     def save_session_action(self, the_action):
         """
         This method store an action object in the session object and returns an integer
@@ -919,10 +893,10 @@ class Session(openerpweb.Controller):
         :return: A key identifying the saved action.
         :rtype: integer
         """
-        saved_actions = req.httpsession.get('saved_actions')
+        saved_actions = request.httpsession.get('saved_actions')
         if not saved_actions:
             saved_actions = {"next":1, "actions":{}}
-            req.httpsession['saved_actions'] = saved_actions
+            request.httpsession['saved_actions'] = saved_actions
         # we don't allow more than 10 stored actions
         if len(saved_actions["actions"]) >= 10:
             del saved_actions["actions"][min(saved_actions["actions"])]
@@ -931,7 +905,7 @@ class Session(openerpweb.Controller):
         saved_actions["next"] = key + 1
         return key
 
-    @openerpweb.jsonrequest
+    @http.route('/web/session/get_session_action', type='json', auth="user")
     def get_session_action(self, key):
         """
         Gets back a previously saved action. This method can return None if the action
@@ -942,57 +916,56 @@ class Session(openerpweb.Controller):
         :return: The saved action or None.
         :rtype: anything
         """
-        saved_actions = req.httpsession.get('saved_actions')
+        saved_actions = request.httpsession.get('saved_actions')
         if not saved_actions:
             return None
         return saved_actions["actions"].get(key)
 
-    @openerpweb.jsonrequest
+    @http.route('/web/session/check', type='json', auth="user")
     def check(self):
-        req.session.assert_valid()
+        request.session.assert_valid()
         return None
 
-    @openerpweb.jsonrequest
+    @http.route('/web/session/destroy', type='json', auth="user")
     def destroy(self):
-        req.session._suicide = True
+        request.session._suicide = True
 
-class Menu(openerpweb.Controller):
-    _cp_path = "/web/menu"
+class Menu(http.Controller):
 
-    @openerpweb.jsonrequest
+    @http.route('/web/menu/get_user_roots', type='json', auth="user")
     def get_user_roots(self):
         """ Return all root menu ids visible for the session user.
 
         :return: the root menu ids
         :rtype: list(int)
         """
-        s = req.session
+        s = request.session
         Menus = s.model('ir.ui.menu')
         # If a menu action is defined use its domain to get the root menu items
         user_menu_id = s.model('res.users').read([s._uid], ['menu_id'],
-                                                 req.context)[0]['menu_id']
+                                                 request.context)[0]['menu_id']
 
         menu_domain = [('parent_id', '=', False)]
         if user_menu_id:
             domain_string = s.model('ir.actions.act_window').read(
-                [user_menu_id[0]], ['domain'],req.context)[0]['domain']
+                [user_menu_id[0]], ['domain'],request.context)[0]['domain']
             if domain_string:
                 menu_domain = ast.literal_eval(domain_string)
 
-        return Menus.search(menu_domain, 0, False, False, req.context)
+        return Menus.search(menu_domain, 0, False, False, request.context)
 
-    @openerpweb.jsonrequest
+    @http.route('/web/menu/load', type='json', auth="user")
     def load(self):
         """ Loads all menu items (all applications and their sub-menus).
 
         :return: the menu root
         :rtype: dict('children': menu_nodes)
         """
-        Menus = req.session.model('ir.ui.menu')
+        Menus = request.session.model('ir.ui.menu')
 
         fields = ['name', 'sequence', 'parent_id', 'action']
         menu_root_ids = self.get_user_roots()
-        menu_roots = Menus.read(menu_root_ids, fields, req.context) if menu_root_ids else []
+        menu_roots = Menus.read(menu_root_ids, fields, request.context) if menu_root_ids else []
         menu_root = {
             'id': False,
             'name': 'root',
@@ -1005,8 +978,8 @@ class Menu(openerpweb.Controller):
 
         # menus are loaded fully unlike a regular tree view, cause there are a
         # limited number of items (752 when all 6.1 addons are installed)
-        menu_ids = Menus.search([('id', 'child_of', menu_root_ids)], 0, False, False, req.context)
-        menu_items = Menus.read(menu_ids, fields, req.context)
+        menu_ids = Menus.search([('id', 'child_of', menu_root_ids)], 0, False, False, request.context)
+        menu_items = Menus.read(menu_ids, fields, request.context)
         # adds roots at the end of the sequence, so that they will overwrite
         # equivalent menu items from full menu read when put into id:item
         # mapping, resulting in children being correctly set on the roots.
@@ -1032,26 +1005,25 @@ class Menu(openerpweb.Controller):
 
         return menu_root
 
-    @openerpweb.jsonrequest
+    @http.route('/web/menu/load_needaction', type='json', auth="user")
     def load_needaction(self, menu_ids):
         """ Loads needaction counters for specific menu ids.
 
             :return: needaction data
             :rtype: dict(menu_id: {'needaction_enabled': boolean, 'needaction_counter': int})
         """
-        return req.session.model('ir.ui.menu').get_needaction_data(menu_ids, req.context)
+        return request.session.model('ir.ui.menu').get_needaction_data(menu_ids, request.context)
 
-    @openerpweb.jsonrequest
+    @http.route('/web/menu/action', type='json', auth="user")
     def action(self, menu_id):
         # still used by web_shortcut
         actions = load_actions_from_ir_values('action', 'tree_but_open',
                                              [('ir.ui.menu', menu_id)], False)
         return {"action": actions}
 
-class DataSet(openerpweb.Controller):
-    _cp_path = "/web/dataset"
+class DataSet(http.Controller):
 
-    @openerpweb.jsonrequest
+    @http.route('/web/dataset/search_read', type='json', auth="user")
     def search_read(self, model, fields=False, offset=0, limit=False, domain=None, sort=None):
         return self.do_search_read(model, fields, offset, limit, domain, sort)
     def do_search_read(self, model, fields=False, offset=0, limit=False, domain=None
@@ -1071,12 +1043,12 @@ class DataSet(openerpweb.Controller):
                   matching fields selection set)
         :rtype: list
         """
-        Model = req.session.model(model)
+        Model = request.session.model(model)
 
         ids = Model.search(domain, offset or 0, limit or False, sort or False,
-                           req.context)
+                           request.context)
         if limit and len(ids) == limit:
-            length = Model.search_count(domain, req.context)
+            length = Model.search_count(domain, request.context)
         else:
             length = len(ids) + (offset or 0)
         if fields and fields == ['id']:
@@ -1086,18 +1058,18 @@ class DataSet(openerpweb.Controller):
                 'records': [{'id': id} for id in ids]
             }
 
-        records = Model.read(ids, fields or False, req.context)
+        records = Model.read(ids, fields or False, request.context)
         records.sort(key=lambda obj: ids.index(obj['id']))
         return {
             'length': length,
             'records': records
         }
 
-    @openerpweb.jsonrequest
+    @http.route('/web/dataset/load', type='json', auth="user")
     def load(self, model, id, fields):
-        m = req.session.model(model)
+        m = request.session.model(model)
         value = {}
-        r = m.read([id], False, req.context)
+        r = m.read([id], False, request.context)
         if r:
             value = r[0]
         return {'value': value}
@@ -1109,36 +1081,36 @@ class DataSet(openerpweb.Controller):
         # Temporary implements future display_name special field for model#read()
         if method == 'read' and kwargs.get('context', {}).get('future_display_name'):
             if 'display_name' in args[1]:
-                names = dict(req.session.model(model).name_get(args[0], **kwargs))
+                names = dict(request.session.model(model).name_get(args[0], **kwargs))
                 args[1].remove('display_name')
-                records = req.session.model(model).read(*args, **kwargs)
+                records = request.session.model(model).read(*args, **kwargs)
                 for record in records:
                     record['display_name'] = \
                         names.get(record['id']) or "%s#%d" % (model, (record['id']))
                 return records
 
-        return getattr(req.session.model(model), method)(*args, **kwargs)
+        return getattr(request.session.model(model), method)(*args, **kwargs)
 
-    @openerpweb.jsonrequest
+    @http.route('/web/dataset/call', type='json', auth="user")
     def call(self, model, method, args, domain_id=None, context_id=None):
         return self._call_kw(model, method, args, {})
 
-    @openerpweb.jsonrequest
-    def call_kw(self, model, method, args, kwargs):
+    @http.route(['/web/dataset/call_kw', '/web/dataset/call_kw/<path:path>'], type='json', auth="user")
+    def call_kw(self, model, method, args, kwargs, path=None):
         return self._call_kw(model, method, args, kwargs)
 
-    @openerpweb.jsonrequest
+    @http.route('/web/dataset/call_button', type='json', auth="user")
     def call_button(self, model, method, args, domain_id=None, context_id=None):
         action = self._call_kw(model, method, args, {})
         if isinstance(action, dict) and action.get('type') != '':
             return clean_action(action)
         return False
 
-    @openerpweb.jsonrequest
+    @http.route('/web/dataset/exec_workflow', type='json', auth="user")
     def exec_workflow(self, model, id, signal):
-        return req.session.exec_workflow(model, id, signal)
+        return request.session.exec_workflow(model, id, signal)
 
-    @openerpweb.jsonrequest
+    @http.route('/web/dataset/resequence', type='json', auth="user")
     def resequence(self, model, ids, field='sequence', offset=0):
         """ Re-sequences a number of records in the model, by their ids
 
@@ -1153,7 +1125,7 @@ class DataSet(openerpweb.Controller):
                            starting the resequencing from an arbitrary number,
                            defaults to ``0``
         """
-        m = req.session.model(model)
+        m = request.session.model(model)
         if not m.fields_get([field]):
             return False
         # python 2.6 has no start parameter
@@ -1161,51 +1133,48 @@ class DataSet(openerpweb.Controller):
             m.write(id, { field: i + offset })
         return True
 
-class View(openerpweb.Controller):
-    _cp_path = "/web/view"
+class View(http.Controller):
 
-    @openerpweb.jsonrequest
+    @http.route('/web/view/add_custom', type='json', auth="user")
     def add_custom(self, view_id, arch):
-        CustomView = req.session.model('ir.ui.view.custom')
+        CustomView = request.session.model('ir.ui.view.custom')
         CustomView.create({
-            'user_id': req.session._uid,
+            'user_id': request.session._uid,
             'ref_id': view_id,
             'arch': arch
-        }, req.context)
+        }, request.context)
         return {'result': True}
 
-    @openerpweb.jsonrequest
+    @http.route('/web/view/undo_custom', type='json', auth="user")
     def undo_custom(self, view_id, reset=False):
-        CustomView = req.session.model('ir.ui.view.custom')
-        vcustom = CustomView.search([('user_id', '=', req.session._uid), ('ref_id' ,'=', view_id)],
-                                    0, False, False, req.context)
+        CustomView = request.session.model('ir.ui.view.custom')
+        vcustom = CustomView.search([('user_id', '=', request.session._uid), ('ref_id' ,'=', view_id)],
+                                    0, False, False, request.context)
         if vcustom:
             if reset:
-                CustomView.unlink(vcustom, req.context)
+                CustomView.unlink(vcustom, request.context)
             else:
-                CustomView.unlink([vcustom[0]], req.context)
+                CustomView.unlink([vcustom[0]], request.context)
             return {'result': True}
         return {'result': False}
 
 class TreeView(View):
-    _cp_path = "/web/treeview"
 
-    @openerpweb.jsonrequest
+    @http.route('/web/treeview/action', type='json', auth="user")
     def action(self, model, id):
         return load_actions_from_ir_values(
             'action', 'tree_but_open',[(model, id)],
             False)
 
-class Binary(openerpweb.Controller):
-    _cp_path = "/web/binary"
+class Binary(http.Controller):
 
-    @openerpweb.httprequest
+    @http.route('/web/binary/image', type='http', auth="user")
     def image(self, model, id, field, **kw):
         last_update = '__last_update'
-        Model = req.session.model(model)
+        Model = request.session.model(model)
         headers = [('Content-Type', 'image/png')]
-        etag = req.httprequest.headers.get('If-None-Match')
-        hashed_session = hashlib.md5(req.session_id).hexdigest()
+        etag = request.httprequest.headers.get('If-None-Match')
+        hashed_session = hashlib.md5(request.session_id).hexdigest()
         retag = hashed_session
         id = None if not id else simplejson.loads(id)
         if type(id) is list:
@@ -1215,15 +1184,15 @@ class Binary(openerpweb.Controller):
                 if not id and hashed_session == etag:
                     return werkzeug.wrappers.Response(status=304)
                 else:
-                    date = Model.read([id], [last_update], req.context)[0].get(last_update)
+                    date = Model.read([id], [last_update], request.context)[0].get(last_update)
                     if hashlib.md5(date).hexdigest() == etag:
                         return werkzeug.wrappers.Response(status=304)
 
             if not id:
-                res = Model.default_get([field], req.context).get(field)
+                res = Model.default_get([field], request.context).get(field)
                 image_base64 = res
             else:
-                res = Model.read([id], [last_update, field], req.context)[0]
+                res = Model.read([id], [last_update, field], request.context)[0]
                 retag = hashlib.md5(res.get(last_update)).hexdigest()
                 image_base64 = res.get(field)
 
@@ -1248,13 +1217,13 @@ class Binary(openerpweb.Controller):
             headers.append(('Cache-Control', 'no-cache' if ncache == 0 else 'max-age=%s' % (ncache)))
         except:
             pass
-        return req.make_response(image_data, headers)
+        return request.make_response(image_data, headers)
 
     def placeholder(self, image='placeholder.png'):
-        addons_path = openerpweb.addons_manifest['web']['addons_path']
+        addons_path = http.addons_manifest['web']['addons_path']
         return open(os.path.join(addons_path, 'web', 'static', 'src', 'img', image), 'rb').read()
 
-    @openerpweb.httprequest
+    @http.route('/web/binary/saveas', type='http', auth="user")
     def saveas(self, model, field, id=None, filename_field=None, **kw):
         """ Download link for files stored as binary fields.
 
@@ -1268,26 +1237,26 @@ class Binary(openerpweb.Controller):
         :param str filename_field: field holding the file's name, if any
         :returns: :class:`werkzeug.wrappers.Response`
         """
-        Model = req.session.model(model)
+        Model = request.session.model(model)
         fields = [field]
         if filename_field:
             fields.append(filename_field)
         if id:
-            res = Model.read([int(id)], fields, req.context)[0]
+            res = Model.read([int(id)], fields, request.context)[0]
         else:
-            res = Model.default_get(fields, req.context)
+            res = Model.default_get(fields, request.context)
         filecontent = base64.b64decode(res.get(field, ''))
         if not filecontent:
-            return req.not_found()
+            return request.not_found()
         else:
             filename = '%s_%s' % (model.replace('.', '_'), id)
             if filename_field:
                 filename = res.get(filename_field, '') or filename
-            return req.make_response(filecontent,
+            return request.make_response(filecontent,
                 [('Content-Type', 'application/octet-stream'),
                  ('Content-Disposition', content_disposition(filename))])
 
-    @openerpweb.httprequest
+    @http.route('/web/binary/saveas_ajax', type='http', auth="user")
     def saveas_ajax(self, data, token):
         jdata = simplejson.loads(data)
         model = jdata['model']
@@ -1297,7 +1266,7 @@ class Binary(openerpweb.Controller):
         filename_field = jdata.get('filename_field', None)
         context = jdata.get('context', {})
 
-        Model = req.session.model(model)
+        Model = request.session.model(model)
         fields = [field]
         if filename_field:
             fields.append(filename_field)
@@ -1315,12 +1284,12 @@ class Binary(openerpweb.Controller):
             filename = '%s_%s' % (model.replace('.', '_'), id)
             if filename_field:
                 filename = res.get(filename_field, '') or filename
-            return req.make_response(filecontent,
+            return request.make_response(filecontent,
                 headers=[('Content-Type', 'application/octet-stream'),
                         ('Content-Disposition', content_disposition(filename))],
                 cookies={'fileToken': int(token)})
 
-    @openerpweb.httprequest
+    @http.route('/web/binary/upload', type='http', auth="user")
     def upload(self, callback, ufile):
         # TODO: might be useful to have a configuration flag for max-length file uploads
         out = """<script language="javascript" type="text/javascript">
@@ -1335,9 +1304,9 @@ class Binary(openerpweb.Controller):
             args = [False, e.message]
         return out % (simplejson.dumps(callback), simplejson.dumps(args))
 
-    @openerpweb.httprequest
+    @http.route('/web/binary/upload_attachment', type='http', auth="user")
     def upload_attachment(self, callback, model, id, ufile):
-        Model = req.session.model('ir.attachment')
+        Model = request.session.model('ir.attachment')
         out = """<script language="javascript" type="text/javascript">
                     var win = window.top.window;
                     win.jQuery(win).trigger(%s, %s);
@@ -1349,7 +1318,7 @@ class Binary(openerpweb.Controller):
                 'datas_fname': ufile.filename,
                 'res_model': model,
                 'res_id': int(id)
-            }, req.context)
+            }, request.context)
             args = {
                 'filename': ufile.filename,
                 'id':  attachment_id
@@ -1358,13 +1327,13 @@ class Binary(openerpweb.Controller):
             args = {'error': "Something horrible happened"}
         return out % (simplejson.dumps(callback), simplejson.dumps(args))
 
-    @openerpweb.httprequest
+    @http.route('/web/binary/company_logo', type='http', auth="none")
     def company_logo(self, dbname=None):
         # TODO add etag, refactor to use /image code for etag
         uid = None
-        if req.session._db:
-            dbname = req.session._db
-            uid = req.session._uid
+        if request.session._db:
+            dbname = request.session._db
+            uid = request.session._uid
         elif dbname is None:
             dbname = db_monodb()
 
@@ -1396,69 +1365,62 @@ class Binary(openerpweb.Controller):
             ('Content-Type', 'image/png'),
             ('Content-Length', len(image_data)),
         ]
-        return req.make_response(image_data, headers)
+        return request.make_response(image_data, headers)
 
-class Action(openerpweb.Controller):
-    _cp_path = "/web/action"
+class Action(http.Controller):
 
-    @openerpweb.jsonrequest
+    @http.route('/web/action/load', type='json', auth="user")
     def load(self, action_id, do_not_eval=False):
-        Actions = req.session.model('ir.actions.actions')
+        Actions = request.session.model('ir.actions.actions')
         value = False
         try:
             action_id = int(action_id)
         except ValueError:
             try:
                 module, xmlid = action_id.split('.', 1)
-                model, action_id = req.session.model('ir.model.data').get_object_reference(module, xmlid)
+                model, action_id = request.session.model('ir.model.data').get_object_reference(module, xmlid)
                 assert model.startswith('ir.actions.')
             except Exception:
                 action_id = 0   # force failed read
 
-        base_action = Actions.read([action_id], ['type'], req.context)
+        base_action = Actions.read([action_id], ['type'], request.context)
         if base_action:
             ctx = {}
             action_type = base_action[0]['type']
             if action_type == 'ir.actions.report.xml':
                 ctx.update({'bin_size': True})
-            ctx.update(req.context)
-            action = req.session.model(action_type).read([action_id], False, ctx)
+            ctx.update(request.context)
+            action = request.session.model(action_type).read([action_id], False, ctx)
             if action:
                 value = clean_action(action[0])
         return value
 
-    @openerpweb.jsonrequest
+    @http.route('/web/action/run', type='json', auth="user")
     def run(self, action_id):
-        return_action = req.session.model('ir.actions.server').run(
-            [action_id], req.context)
+        return_action = request.session.model('ir.actions.server').run(
+            [action_id], request.context)
         if return_action:
             return clean_action(return_action)
         else:
             return False
 
-class Export(openerpweb.Controller):
-    _cp_path = "/web/export"
+class Export(http.Controller):
 
-    @openerpweb.jsonrequest
+    @http.route('/web/export/formats', type='json', auth="user")
     def formats(self):
         """ Returns all valid export formats
 
         :returns: for each export format, a pair of identifier and printable name
         :rtype: [(str, str)]
         """
-        return sorted([
-            controller.fmt
-            for path, controller in openerpweb.controllers_path.iteritems()
-            if path.startswith(self._cp_path)
-            if hasattr(controller, 'fmt')
-        ], key=operator.itemgetter("label"))
+        return ["CSV", "Excel"]
 
     def fields_get(self, model):
-        Model = req.session.model(model)
-        fields = Model.fields_get(False, req.context)
+        Model = request.session.model(model)
+        fields = Model.fields_get(False, request.context)
         return fields
 
-    @openerpweb.jsonrequest
+    @http.route('/web/export/get_fields', type='json', auth="user")
     def get_fields(self, model, prefix='', parent_name= '',
                    import_compat=True, parent_field_type=None,
                    exclude=None):
@@ -1509,11 +1471,11 @@ class Export(openerpweb.Controller):
 
         return records
 
-    @openerpweb.jsonrequest
+    @http.route('/web/export/namelist', type='json', auth="user")
     def namelist(self, model, export_id):
         # TODO: namelist really has no reason to be in Python (although itertools.groupby helps)
-        export = req.session.model("ir.exports").read([export_id])[0]
-        export_fields_list = req.session.model("ir.exports.line").read(
+        export = request.session.model("ir.exports").read([export_id])[0]
+        export_fields_list = request.session.model("ir.exports.line").read(
             export['export_fields'])
 
         fields_data = self.fields_info(
@@ -1602,18 +1564,17 @@ class ExportFormat(object):
         """
         raise NotImplementedError()
 
-    @openerpweb.httprequest
-    def index(self, data, token):
+    def base(self, data, token):
         model, fields, ids, domain, import_compat = \
             operator.itemgetter('model', 'fields', 'ids', 'domain',
                                 'import_compat')(
                 simplejson.loads(data))
 
-        Model = req.session.model(model)
-        ids = ids or Model.search(domain, 0, False, False, req.context)
+        Model = request.session.model(model)
+        ids = ids or Model.search(domain, 0, False, False, request.context)
 
         field_names = map(operator.itemgetter('name'), fields)
-        import_data = Model.export_data(ids, field_names, req.context).get('datas',[])
+        import_data = Model.export_data(ids, field_names, request.context).get('datas',[])
 
         if import_compat:
             columns_headers = field_names
@@ -1621,16 +1582,19 @@ class ExportFormat(object):
             columns_headers = [val['label'].strip() for val in fields]
 
 
-        return req.make_response(self.from_data(columns_headers, import_data),
+        return request.make_response(self.from_data(columns_headers, import_data),
             headers=[('Content-Disposition',
                             content_disposition(self.filename(model))),
                      ('Content-Type', self.content_type)],
             cookies={'fileToken': int(token)})
 
 class CSVExport(ExportFormat, http.Controller):
-    _cp_path = '/web/export/csv'
     fmt = {'tag': 'csv', 'label': 'CSV'}
 
+    @http.route('/web/export/csv', type='http', auth="user")
+    def index(self, data, token):
+        return self.base(data, token)
+
     @property
     def content_type(self):
         return 'text/csv;charset=utf8'
@@ -1663,13 +1627,16 @@ class CSVExport(ExportFormat, http.Controller):
         return data
 
 class ExcelExport(ExportFormat, http.Controller):
-    _cp_path = '/web/export/xls'
     fmt = {
         'tag': 'xls',
         'label': 'Excel',
         'error': None if xlwt else "XLWT required"
     }
 
+    @http.route('/web/export/xls', type='http', auth="user")
+    def index(self, data, token):
+        return self.base(data, token)
+
     @property
     def content_type(self):
         return 'application/vnd.ms-excel'
@@ -1701,8 +1668,7 @@ class ExcelExport(ExportFormat, http.Controller):
         fp.close()
         return data
 
-class Reports(openerpweb.Controller):
-    _cp_path = "/web/report"
+class Reports(http.Controller):
     POLLING_DELAY = 0.25
     TYPES_MAPPING = {
         'doc': 'application/vnd.ms-word',
@@ -1713,12 +1679,12 @@ class Reports(openerpweb.Controller):
         'xls': 'application/vnd.ms-excel',
     }
 
-    @openerpweb.httprequest
+    @http.route('/web/report', type='http', auth="user")
     def index(self, action, token):
         action = simplejson.loads(action)
 
-        report_srv = req.session.proxy("report")
-        context = dict(req.context)
+        report_srv = request.session.proxy("report")
+        context = dict(request.context)
         context.update(action["context"])
 
         report_data = {}
@@ -1731,14 +1697,14 @@ class Reports(openerpweb.Controller):
             report_data.update(action['datas'])
 
         report_id = report_srv.report(
-            req.session._db, req.session._uid, req.session._password,
+            request.session._db, request.session._uid, request.session._password,
             action["report_name"], report_ids,
             report_data, context)
 
         report_struct = None
         while True:
             report_struct = report_srv.report_get(
-                req.session._db, req.session._uid, req.session._password, report_id)
+                request.session._db, request.session._uid, request.session._password, report_id)
             if report_struct["state"]:
                 break
 
@@ -1751,7 +1717,7 @@ class Reports(openerpweb.Controller):
             report_struct['format'], 'octet-stream')
         file_name = action.get('name', 'report')
         if 'name' not in action:
-            reports = req.session.model('ir.actions.report.xml')
+            reports = request.session.model('ir.actions.report.xml')
             res_id = reports.search([('report_name', '=', action['report_name']),],
                                     0, False, False, context)
             if len(res_id) > 0:
@@ -1760,7 +1726,7 @@ class Reports(openerpweb.Controller):
                 file_name = action['report_name']
         file_name = '%s.%s' % (file_name, report_struct['format'])
 
-        return req.make_response(report,
+        return request.make_response(report,
              headers=[
                  ('Content-Disposition', content_disposition(file_name)),
                  ('Content-Type', report_mimetype),
diff --git a/addons/web/controllers/testing.py b/addons/web/controllers/testing.py
index b6327bf4622..36afbd1e653 100644
--- a/addons/web/controllers/testing.py
+++ b/addons/web/controllers/testing.py
@@ -86,9 +86,8 @@ TESTING = Template(u"""<!DOCTYPE html>
 """, default_filters=['h'])
 
 class TestRunnerController(http.Controller):
-    _cp_path = '/web/tests'
 
-    @http.httprequest
+    @http.route('/web/tests', type='http', auth="none")
     def index(self, req, mod=None, **kwargs):
         ms = module.get_modules()
         manifests = dict(
diff --git a/addons/web/doc/index.rst b/addons/web/doc/index.rst
index 7127bb975ed..650c12f55ec 100644
--- a/addons/web/doc/index.rst
+++ b/addons/web/doc/index.rst
@@ -6,32 +6,49 @@
 Welcome to OpenERP Web's documentation!
 =======================================
 
-Contents:
+Basics
+------
 
 .. toctree::
     :maxdepth: 1
 
     module
-    widget
+    changelog-7.0
 
+Server-Side Web Framework
+-------------------------
 
-    async
-    rpc
-    qweb
-    client_action
+.. toctree::
+    :maxdepth: 1
+
+    web_controllers
+
+Javascript
+----------
+
+.. toctree::
+    :maxdepth: 1
 
     guidelines
-
+    widget
+    rpc
+    async
+    qweb
+    client_action
     testing
 
+Views
+-----
+
+.. toctree::
+    :maxdepth: 1
+
     search_view
     list_view
     form_view
 
-    changelog-7.0
-
 Indices and tables
-==================
+------------------
 
 * :ref:`genindex`
 * :ref:`modindex`
diff --git a/addons/web/doc/web_controllers.rst b/addons/web/doc/web_controllers.rst
new file mode 100644
index 00000000000..86ac0248e7e
--- /dev/null
+++ b/addons/web/doc/web_controllers.rst
@@ -0,0 +1,166 @@
+
+Web Controllers
+===============
+
+Web controllers are classes in OpenERP able to catch the http requests sent by any browser. They allow to generate
+html pages to be served like any web server, implement new methods to be used by the Javascript client, etc...
+
+Controllers File
+----------------
+
+By convention the controllers should be placed in the controllers directory of the module. Example:
+
+.. code-block:: text
+
+    web_example
+    ├── controllers
+    │   ├── __init__.py
+    │   └── my_controllers.py
+    ├── __init__.py
+    └── __openerp__.py
+
+In ``__init__.py`` you must add:
+
+::
+
+    import controllers
+
+And here is the content of ``controllers/__init__.py``:
+
+::
+    
+    import my_controllers
+
+Now you can put the following content in ``controllers/my_controllers.py``:
+
+::
+
+    import openerp.addons.web.http as http
+    from openerp.addons.web.http import request
+
+
+Controller Declaration
+----------------------
+
+In your controllers file, you can now declare a controller this way:
+
+::
+
+    class MyController(http.Controller):
+
+        @http.route('/my_url/some_html', type="http")
+        def some_html(self):
+            return "<h1>This is a test</h1>"
+
+        @http.route('/my_url/some_json', type="json")
+        def some_json(self):
+            return {"sample_dictionary": "This is a sample JSON dictionary"}
+
+A controller must inherit from ``http.Controller``. Each time you define a method with ``@http.route()`` it defines a
+url to match. As example, the ``some_html()`` method will be called a client query the ``/my_url/some_html`` url.
+
+Pure HTTP Requests
+------------------
+
+You can define methods to get any normal http requests by passing ``'http'`` to the ``type`` argument of
+``http.route()``. When doing so, you get the HTTP parameters as named parameters of the method:
+
+::
+
+    @http.route('/say_hello', type="http")
+    def say_hello(self, name):
+        return "<h1>Hello %s</h1>" % name
+
+This url could be contacted by typing this url in a browser: ``http://localhost:8069/say_hello?name=Nicolas``.
+
+JSON Requests
+-------------
+
+Methods that received JSON can be defined by passing ``'json'`` to the ``type`` argument of ``http.route()``. The
+OpenERP Javascript client can contact these methods using the JSON-RPC protocol. JSON methods must return JSON. Like the
+HTTP methods they receive arguments as named parameters (except these arguments are JSON-RPC parameters).
+
+::
+
+    @http.route('/division', type="json")
+    def division(self, i, j):
+        return i / j # returns a number
+
+URL Patterns
+------------
+
+Any URL passed to ``http.route()`` can contain patterns. Example:
+
+::
+
+    @http.route('/files/<path:file_path>', type="http")
+    def files(self, file_path):
+        ... # return a file identified by the path store in the 'my_path' variable
+
+When such patterns are used, the method will received additional parameters that correspond to the parameters defined in
+the url. For exact documentation about url patterns, see Werkzeug's documentation:
+http://werkzeug.pocoo.org/docs/routing/ .
+
+Also note you can pass multiple urls to ``http.route()``:
+
+
+::
+
+    @http.route(['/files/<path:file_path>', '/other_url/<path:file_path>'], type="http")
+    def files(self, file_path):
+        ...
+
+Contacting Models
+-----------------
+
+To use the database you must access the OpenERP models. The global ``request`` object provides the necessary objects:
+
+::
+
+    @http.route('/my_name', type="http")
+    def my_name(self):
+        my_user_record = request.registry.get("res.users").browse(request.cr, request.uid, request.uid)
+        return "<h1>Your name is %s</h1>" % my_user_record.name
+
+``request.registry`` is the registry that gives you access to the models. It is the equivalent of ``self.pool`` when
+working inside OpenERP models.
+
+``request.cr`` is the cursor object. This is the ``cr`` parameter you have to pass as first argument of every model
+method in OpenERP.
+
+``request.uid`` is the id of the current logged in user. This is the ``uid`` parameter you have to pass as second
+argument of every model method in OpenERP.
+
+Authorization Levels
+--------------------
+
+By default, all methods can only be used by users logged into OpenERP (OpenERP uses cookies to track logged users).
+There are some cases when you need to enable not-logged in users to access some methods. To do so, add the ``'db'``
+value to the ``auth`` parameter of ``http.route()``:
+
+::
+
+    @http.route('/hello', type="http", auth="db")
+    def hello(self):
+        return "<div>Hello unknown user!</div>"
+
+Please note the ``request.uid`` user id will be ``None`` inside this method call. This is due to the fact no user was
+authenticated.
+
+Overriding Controllers
+----------------------
+
+Existing routes can be overridden. To do so, create a controller that inherit the controller containing the route you
+want to override. Example that redefine the home page of your OpenERP application.
+
+::
+
+    import openerp.addons.web.controllers.main as main
+
+    class Home2(main.Home):
+        @http.route('/', type="http", auth="db")
+        def index(self):
+            return "<div>This is my new home page.</div>"
+
+By re-defining the ``index()`` method, you change the behavior of the original ``Home`` class. Now the ``'/'`` route
+will match the new ``index()`` method in ``Home2``.
diff --git a/addons/web/http.py b/addons/web/http.py
index 5872e80685b..0c2bb1e3744 100644
--- a/addons/web/http.py
+++ b/addons/web/http.py
@@ -20,6 +20,7 @@ import traceback
 import urlparse
 import uuid
 import errno
+import re
 
 import babel.core
 import simplejson
@@ -29,10 +30,11 @@ import werkzeug.exceptions
 import werkzeug.utils
 import werkzeug.wrappers
 import werkzeug.wsgi
+import werkzeug.routing as routing
+import urllib2
 
 import openerp
-
-import session
+import openerp.service.security as security
 
 import inspect
 import functools
@@ -82,21 +84,48 @@ class WebRequest(object):
     .. attribute:: debug
 
         ``bool``, indicates whether the debug mode is active on the client
+
+    .. attribute:: db
+
+        ``str``, the name of the database linked to the current request. Can be ``None``
+        if the current request uses the ``none`` authentication.
+
+    .. attribute:: uid
+
+        ``int``, the id of the user related to the current request. Can be ``None``
+        if the current request uses the ``none`` or the ``db`` authenticatoin.
     """
-    def __init__(self, request):
-        self.httprequest = request
+    def __init__(self, httprequest):
+        self.httprequest = httprequest
         self.httpresponse = None
-        self.httpsession = request.session
+        self.httpsession = httprequest.session
+        self.db = None
+        self.uid = None
+        self.func = None
+        self.auth_method = None
+        self._cr_cm = None
+        self._cr = None
+        self.func_request_type = None
 
     def init(self, params):
         self.params = dict(params)
         # OpenERP session setup
-        self.session_id = self.params.pop("session_id", None) or uuid.uuid4().hex
+        self.session_id = self.params.pop("session_id", None)
+        if not self.session_id:
+            i0 = self.httprequest.cookies.get("instance0|session_id", None)
+            if i0:
+                self.session_id = simplejson.loads(urllib2.unquote(i0))
+            else:
+                self.session_id = uuid.uuid4().hex
         self.session = self.httpsession.get(self.session_id)
         if not self.session:
-            self.session = session.OpenERPSession()
+            self.session = OpenERPSession()
             self.httpsession[self.session_id] = self.session
 
+        with set_request(self):
+            self.db = self.session._db or db_monodb()
+
+        # TODO: remove this
         # set db/uid trackers - they're cleaned up at the WSGI
         # dispatching phase in openerp.service.wsgi_server.application
         if self.session._db:
@@ -121,12 +150,100 @@ class WebRequest(object):
         # we use _ as seprator where RFC2616 uses '-'
         self.lang = lang.replace('-', '_')
 
-    @contextlib.contextmanager
-    def registry_cr(self):
-        dbname = self.session._db or openerp.addons.web.controllers.main.db_monodb(self)
-        registry = openerp.modules.registry.RegistryManager.get(dbname.lower())
-        with registry.cursor() as cr:
-            yield (registry, cr)
+    def _authenticate(self):
+        if self.auth_method == "none":
+            self.db = None
+            self.uid = None
+        elif self.auth_method == "db":
+            self.db = self.session._db or db_monodb()
+            if not self.db:
+                raise SessionExpiredException("No valid database for request %s" % self.httprequest)
+            self.uid = None
+        else: # auth
+            try:
+                self.session.check_security()
+            except SessionExpiredException, e:
+                raise SessionExpiredException("Session expired for request %s" % self.httprequest)
+            self.db = self.session._db
+            self.uid = self.session._uid
+
+    @property
+    def registry(self):
+        """
+        The registry to the database linked to this request. Can be ``None`` if the current request uses the
+        ``none'' authentication.
+        """
+        return openerp.modules.registry.RegistryManager.get(self.db) if self.db else None
+
+    @property
+    def cr(self):
+        """
+        The cursor initialized for the current method call. If the current request uses the ``none`` authentication
+        trying to access this property will raise an exception.
+        """
+        # some magic to lazy create the cr
+        if not self._cr_cm:
+            self._cr_cm = self.registry.cursor()
+            self._cr = self._cr_cm.__enter__()
+        return self._cr
+
+    def _call_function(self, *args, **kwargs):
+        self._authenticate()
+        try:
+            # ugly syntax only to get the __exit__ arguments to pass to self._cr
+            request = self
+            class with_obj(object):
+                def __enter__(self):
+                    pass
+                def __exit__(self, *args):
+                    if request._cr_cm:
+                        request._cr_cm.__exit__(*args)
+                        request._cr_cm = None
+                        request._cr = None
+
+            with with_obj():
+                if self.func_request_type != self._request_type:
+                    raise Exception("%s, %s: Function declared as capable of handling request of type '%s' but called with a request of type '%s'" \
+                        % (self.func, self.httprequest.path, self.func_request_type, self._request_type))
+                return self.func(*args, **kwargs)
+        finally:
+            # just to be sure no one tries to re-use the request
+            self.db = None
+            self.uid = None
+
+def route(route, type="http", auth="user"):
+    """
+    Decorator marking the decorated method as being a handler for requests. The method must be part of a subclass
+    of ``Controller``.
+
+    Decorator to put on a controller method to inform it does not require a user to be logged. When this decorator
+    is used, ``request.uid`` will be ``None``. The request will still try to detect the database and an exception
+    will be launched if there is no way to guess it.
+
+    :param route: string or array. The route part that will determine which http requests will match the decorated
+    method. Can be a single string or an array of strings. See werkzeug's routing documentation for the format of
+    route expression ( http://werkzeug.pocoo.org/docs/routing/ ).
+    :param type: The type of request, can be ``'http'`` or ``'json'``.
+    :param auth: The type of authentication method, can on of the following:
+
+        * ``auth``: The user must be authenticated.
+        * ``db``: There is no need for the user to be authenticated but there must be a way to find the current
+        database.
+        * ``none``: The method is always active, even if there is no database. Mainly used by the framework and
+        authentication modules.
+    """
+    assert type in ["http", "json"]
+    assert auth in ["user", "db", "none"]
+    def decorator(f):
+        if isinstance(route, list):
+            f.routes = route
+        else:
+            f.routes = [route]
+        f.exposed = type
+        if getattr(f, "auth", None) is None:
+            f.auth = auth
+        return f
+    return decorator
 
 def reject_nonliteral(dct):
     if '__ref' in dct:
@@ -167,26 +284,30 @@ class JsonRequest(WebRequest):
            "id": null}
 
     """
-    def dispatch(self, method):
-        """ Calls the method asked for by the JSON-RPC2 or JSONP request
+    _request_type = "json"
 
-        :param method: the method which received the request
+    def __init__(self, *args):
+        super(JsonRequest, self).__init__(*args)
+
+        self.jsonp_handler = None
 
-        :returns: an utf8 encoded JSON-RPC2 or JSONP reply
-        """
         args = self.httprequest.args
         jsonp = args.get('jsonp')
-        requestf = None
+        self.jsonp = jsonp
         request = None
         request_id = args.get('id')
 
         if jsonp and self.httprequest.method == 'POST':
             # jsonp 2 steps step1 POST: save call
             self.init(args)
-            self.session.jsonp_requests[request_id] = self.httprequest.form['r']
-            headers=[('Content-Type', 'text/plain; charset=utf-8')]
-            r = werkzeug.wrappers.Response(request_id, headers=headers)
-            return r
+
+            def handler():
+                self.session.jsonp_requests[request_id] = self.httprequest.form['r']
+                headers=[('Content-Type', 'text/plain; charset=utf-8')]
+                r = werkzeug.wrappers.Response(request_id, headers=headers)
+                return r
+            self.jsonp_handler = handler
+            return
         elif jsonp and args.get('r'):
             # jsonp method GET
             request = args.get('r')
@@ -196,22 +317,28 @@ class JsonRequest(WebRequest):
             request = self.session.jsonp_requests.pop(request_id, "")
         else:
             # regular jsonrpc2
-            requestf = self.httprequest.stream
+            request = self.httprequest.stream.read()
 
+        # Read POST content or POST Form Data named "request"
+        self.jsonrequest = simplejson.loads(request, object_hook=reject_nonliteral)
+        self.init(self.jsonrequest.get("params", {}))
+
+    def dispatch(self):
+        """ Calls the method asked for by the JSON-RPC2 or JSONP request
+
+        :returns: an utf8 encoded JSON-RPC2 or JSONP reply
+        """
+        if self.jsonp_handler:
+            return self.jsonp_handler()
         response = {"jsonrpc": "2.0" }
         error = None
         try:
-            # Read POST content or POST Form Data named "request"
-            if requestf:
-                self.jsonrequest = simplejson.load(requestf, object_hook=reject_nonliteral)
-            else:
-                self.jsonrequest = simplejson.loads(request, object_hook=reject_nonliteral)
-            self.init(self.jsonrequest.get("params", {}))
             #if _logger.isEnabledFor(logging.DEBUG):
-            #    _logger.debug("--> %s.%s\n%s", method.im_class.__name__, method.__name__, pprint.pformat(self.jsonrequest))
+            #    _logger.debug("--> %s.%s\n%s", func.im_class.__name__, func.__name__, pprint.pformat(self.jsonrequest))
             response['id'] = self.jsonrequest.get('id')
-            response["result"] = method(**self.params)
-        except session.AuthenticationError, e:
+            response["result"] = self._call_function(**self.params)
+        except AuthenticationError, e:
+            _logger.exception("Exception during JSON request handling.")
             se = serialize_exception(e)
             error = {
                 'code': 100,
@@ -219,6 +346,7 @@ class JsonRequest(WebRequest):
                 'data': se
             }
         except Exception, e:
+            _logger.exception("Exception during JSON request handling.")
             se = serialize_exception(e)
             error = {
                 'code': 200,
@@ -231,13 +359,13 @@ class JsonRequest(WebRequest):
         if _logger.isEnabledFor(logging.DEBUG):
             _logger.debug("<--\n%s", pprint.pformat(response))
 
-        if jsonp:
+        if self.jsonp:
             # If we use jsonp, that's mean we are called from another host
             # Some browser (IE and Safari) do no allow third party cookies
             # We need then to manage http sessions manually.
             response['httpsessionid'] = self.httpsession.sid
             mime = 'application/javascript'
-            body = "%s(%s);" % (jsonp, simplejson.dumps(response),)
+            body = "%s(%s);" % (self.jsonp, simplejson.dumps(response),)
         else:
             mime = 'application/json'
             body = simplejson.dumps(response)
@@ -285,26 +413,34 @@ def jsonrequest(f):
     the ``session_id``, ``context`` and ``debug`` keys (which are stripped out
     beforehand)
     """
-    f.exposed = 'json'
-    return f
+    f.combine = True
+    base = f.__name__
+    if f.__name__ == "index":
+        base = ""
+    return route([base, os.path.join(base, "<path:_ignored_path>")], type="json", auth="user")(f)
 
 class HttpRequest(WebRequest):
     """ Regular GET/POST request
     """
-    def dispatch(self, method):
+    _request_type = "http"
+
+    def __init__(self, *args):
+        super(HttpRequest, self).__init__(*args)
         params = dict(self.httprequest.args)
         params.update(self.httprequest.form)
         params.update(self.httprequest.files)
         self.init(params)
+
+    def dispatch(self):
         akw = {}
         for key, value in self.httprequest.args.iteritems():
             if isinstance(value, basestring) and len(value) < 1024:
                 akw[key] = value
             else:
                 akw[key] = type(value)
-        #_logger.debug("%s --> %s.%s %r", self.httprequest.method, method.im_class.__name__, method.__name__, akw)
+        #_logger.debug("%s --> %s.%s %r", self.httprequest.func, func.im_class.__name__, func.__name__, akw)
         try:
-            r = method(**self.params)
+            r = self._call_function(**self.params)
         except werkzeug.exceptions.HTTPException, e:
             r = e
         except Exception, e:
@@ -360,8 +496,11 @@ def httprequest(f):
     merged in the same dictionary), apart from the ``session_id``, ``context``
     and ``debug`` keys (which are stripped out beforehand)
     """
-    f.exposed = 'http'
-    return f
+    f.combine = True
+    base = f.__name__
+    if f.__name__ == "index":
+        base = ""
+    return route([base, os.path.join(base, "<path:_ignored_path>")], type="http", auth="user")(f)
 
 #----------------------------------------------------------
 # Local storage of requests
@@ -378,6 +517,9 @@ def set_request(request):
             _request_stack.pop()
     return with_obj()
 
+"""
+    A global proxy that always redirect to the current request object.
+"""
 request = _request_stack()
 
 #----------------------------------------------------------
@@ -385,11 +527,7 @@ request = _request_stack()
 #----------------------------------------------------------
 addons_module = {}
 addons_manifest = {}
-controllers_class = []
-controllers_class_path = {}
-controllers_object = {}
-controllers_object_path = {}
-controllers_path = {}
+controllers_per_module = {}
 
 class ControllerType(type):
     def __init__(cls, name, bases, attrs):
@@ -408,47 +546,268 @@ class ControllerType(type):
 
         # store the controller in the controllers list
         name_class = ("%s.%s" % (cls.__module__, cls.__name__), cls)
-        controllers_class.append(name_class)
-        path = attrs.get('_cp_path')
-        if path not in controllers_class_path:
-            controllers_class_path[path] = name_class
+        class_path = name_class[0].split(".")
+        if not class_path[:2] == ["openerp", "addons"]:
+            return
+        # we want to know all modules that have controllers
+        module = class_path[2]
+        controllers_per_module.setdefault(module, [])
+        # but we only store controllers directly inheriting from Controller
+        if not "Controller" in globals() or not Controller in bases:
+            return
+        controllers_per_module.setdefault(module, []).append(name_class)
 
 class Controller(object):
     __metaclass__ = ControllerType
 
-    def __new__(cls, *args, **kwargs):
-        subclasses = [c for c in cls.__subclasses__() if c._cp_path == cls._cp_path]
-        if subclasses:
-            name = "%s (extended by %s)" % (cls.__name__, ', '.join(sub.__name__ for sub in subclasses))
-            cls = type(name, tuple(reversed(subclasses)), {})
-
-        return object.__new__(cls)
-
     def get_wrapped_method(self, name):
         if name in self.__class__._methods_wrapper:
             return functools.partial(self.__class__._methods_wrapper[name], self)
         else:
             return getattr(self, name)
 
+#############################
+# OpenERP Sessions          #
+#############################
+
+class AuthenticationError(Exception):
+    pass
+
+class SessionExpiredException(Exception):
+    pass
+
+class Service(object):
+    """
+        .. deprecated:: 8.0
+        Use ``openerp.netsvc.dispatch_rpc()`` instead.
+    """
+    def __init__(self, session, service_name):
+        self.session = session
+        self.service_name = service_name
+
+    def __getattr__(self, method):
+        def proxy_method(*args):
+            result = openerp.netsvc.dispatch_rpc(self.service_name, method, args)
+            return result
+        return proxy_method
+
+class Model(object):
+    """
+        .. deprecated:: 8.0
+        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+    """
+    def __init__(self, session, model):
+        self.session = session
+        self.model = model
+        self.proxy = self.session.proxy('object')
+
+    def __getattr__(self, method):
+        self.session.assert_valid()
+        def proxy(*args, **kw):
+            # Can't provide any retro-compatibility for this case, so we check it and raise an Exception
+            # to tell the programmer to adapt his code
+            if not request.db or not request.uid or self.session._db != request.db \
+                or self.session._uid != request.uid:
+                raise Exception("Trying to use Model with badly configured database or user.")
+                
+            mod = request.registry.get(self.model)
+            meth = getattr(mod, method)
+            cr = request.cr
+            result = meth(cr, request.uid, *args, **kw)
+            # reorder read
+            if method == "read":
+                if isinstance(result, list) and len(result) > 0 and "id" in result[0]:
+                    index = {}
+                    for r in result:
+                        index[r['id']] = r
+                    result = [index[x] for x in args[0] if x in index]
+            return result
+        return proxy
+
+class OpenERPSession(object):
+    """
+    An OpenERP RPC session, a given user can own multiple such sessions
+    in a web session.
+
+    .. attribute:: context
+
+        The session context, a ``dict``. Can be reloaded by calling
+        :meth:`openerpweb.openerpweb.OpenERPSession.get_context`
+
+    .. attribute:: domains_store
+
+        A ``dict`` matching domain keys to evaluable (but non-literal) domains.
+
+        Used to store references to non-literal domains which need to be
+        round-tripped to the client browser.
+    """
+    def __init__(self):
+        self._creation_time = time.time()
+        self._db = False
+        self._uid = False
+        self._login = False
+        self._password = False
+        self._suicide = False
+        self.context = {}
+        self.jsonp_requests = {}     # FIXME use a LRU
+
+    def authenticate(self, db, login=None, password=None, env=None, uid=None):
+        """
+        Authenticate the current user with the given db, login and password. If successful, store
+        the authentication parameters in the current session and request.
+
+        :param uid: If not None, that user id will be used instead the login to authenticate the user.
+        """
+        if uid is None:
+            uid = openerp.netsvc.dispatch_rpc('common', 'authenticate', [db, login, password, env])
+        else:
+            security.check(db, uid, password)
+        self._db = db
+        self._uid = uid
+        self._login = login
+        self._password = password
+        request.db = db
+        request.uid = uid
+
+        if uid: self.get_context()
+        return uid
+
+    def check_security(self):
+        """
+        Chech the current authentication parameters to know if those are still valid. This method
+        should be called at each request. If the authentication fails, a ``SessionExpiredException``
+        is raised.
+        """
+        if not self._db or not self._uid:
+            raise SessionExpiredException("Session expired")
+        security.check(self._db, self._uid, self._password)
+
+    def get_context(self):
+        """
+        Re-initializes the current user's session context (based on
+        his preferences) by calling res.users.get_context() with the old
+        context.
+
+        :returns: the new context
+        """
+        assert self._uid, "The user needs to be logged-in to initialize his context"
+        self.context = request.registry.get('res.users').context_get(request.cr, request.uid) or {}
+        self.context['uid'] = self._uid
+        self._fix_lang(self.context)
+        return self.context
+
+    def _fix_lang(self, context):
+        """ OpenERP provides languages which may not make sense and/or may not
+        be understood by the web client's libraries.
+
+        Fix those here.
+
+        :param dict context: context to fix
+        """
+        lang = context['lang']
+
+        # inane OpenERP locale
+        if lang == 'ar_AR':
+            lang = 'ar'
+
+        # lang to lang_REGION (datejs only handles lang_REGION, no bare langs)
+        if lang in babel.core.LOCALE_ALIASES:
+            lang = babel.core.LOCALE_ALIASES[lang]
+
+        context['lang'] = lang or 'en_US'
+
+    def send(self, service_name, method, *args):
+        """
+        .. deprecated:: 8.0
+        Use ``openerp.netsvc.dispatch_rpc()`` instead.
+        """
+        return openerp.netsvc.dispatch_rpc(service_name, method, args)
+
+    def proxy(self, service):
+        """
+        .. deprecated:: 8.0
+        Use ``openerp.netsvc.dispatch_rpc()`` instead.
+        """
+        return Service(self, service)
+
+    def assert_valid(self, force=False):
+        """
+        .. deprecated:: 8.0
+        Use ``check_security()`` instead.
+
+        Ensures this session is valid (logged into the openerp server)
+        """
+        if self._uid and not force:
+            return
+        # TODO use authenticate instead of login
+        self._uid = self.proxy("common").login(self._db, self._login, self._password)
+        if not self._uid:
+            raise AuthenticationError("Authentication failure")
+
+    def ensure_valid(self):
+        """
+        .. deprecated:: 8.0
+        Use ``check_security()`` instead.
+        """
+        if self._uid:
+            try:
+                self.assert_valid(True)
+            except Exception:
+                self._uid = None
+
+    def execute(self, model, func, *l, **d):
+        """
+        .. deprecated:: 8.0
+        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+        """
+        model = self.model(model)
+        r = getattr(model, func)(*l, **d)
+        return r
+
+    def exec_workflow(self, model, id, signal):
+        """
+        .. deprecated:: 8.0
+        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+        """
+        self.assert_valid()
+        r = self.proxy('object').exec_workflow(self._db, self._uid, self._password, model, signal, id)
+        return r
+
+    def model(self, model):
+        """
+        .. deprecated:: 8.0
+        Use the resistry and cursor in ``openerp.addons.web.http.request`` instead.
+
+        Get an RPC proxy for the object ``model``, bound to this session.
+
+        :param model: an OpenERP model name
+        :type model: str
+        :rtype: a model object
+        """
+        if self._db == False:
+            raise SessionExpiredException("Session expired")
+
+        return Model(self, model)
+
 #----------------------------------------------------------
 # Session context manager
 #----------------------------------------------------------
 @contextlib.contextmanager
-def session_context(request, session_store, session_lock, sid):
+def session_context(httprequest, session_store, session_lock, sid):
     with session_lock:
         if sid:
-            request.session = session_store.get(sid)
+            httprequest.session = session_store.get(sid)
         else:
-            request.session = session_store.new()
+            httprequest.session = session_store.new()
     try:
-        yield request.session
+        yield httprequest.session
     finally:
         # Remove all OpenERPSession instances with no uid, they're generated
         # either by login process or by HTTP requests without an OpenERP
         # session id, and are generally noise
         removed_sessions = set()
-        for key, value in request.session.items():
-            if not isinstance(value, session.OpenERPSession):
+        for key, value in httprequest.session.items():
+            if not isinstance(value, OpenERPSession):
                 continue
             if getattr(value, '_suicide', False) or (
                         not value._uid
@@ -457,7 +816,7 @@ def session_context(request, session_store, session_lock, sid):
                     and value._creation_time + (60*5) < time.time()):
                 _logger.debug('remove session %s', key)
                 removed_sessions.add(key)
-                del request.session[key]
+                del httprequest.session[key]
 
         with session_lock:
             if sid:
@@ -474,9 +833,9 @@ def session_context(request, session_store, session_lock, sid):
                 # other to get the right result, if we want to merge the
                 # ``context`` dict we'll need something smarter
                 in_store = session_store.get(sid)
-                for k, v in request.session.iteritems():
+                for k, v in httprequest.session.iteritems():
                     stored = in_store.get(k)
-                    if stored and isinstance(v, session.OpenERPSession):
+                    if stored and isinstance(v, OpenERPSession):
                         if hasattr(v, 'contexts_store'):
                             del v.contexts_store
                         if hasattr(v, 'domains_store'):
@@ -488,10 +847,10 @@ def session_context(request, session_store, session_lock, sid):
 
                 # add missing keys
                 for k, v in in_store.iteritems():
-                    if k not in request.session and k not in removed_sessions:
-                        request.session[k] = v
+                    if k not in httprequest.session and k not in removed_sessions:
+                        httprequest.session[k] = v
 
-            session_store.save(request.session)
+            session_store.save(httprequest.session)
 
 def session_gc(session_store):
     if random.random() < 0.001:
@@ -563,6 +922,9 @@ class Root(object):
         self.addons = {}
         self.statics = {}
 
+        self.db_routers = {}
+        self.db_routers_lock = threading.Lock()
+
         self.load_addons()
 
         # Setup http sessions
@@ -571,6 +933,7 @@ class Root(object):
         self.session_lock = threading.Lock()
         _logger.debug('HTTP sessions stored in: %s', path)
 
+
     def __call__(self, environ, start_response):
         """ Handle a WSGI request
         """
@@ -583,23 +946,33 @@ class Root(object):
 
         Call the object directly.
         """
-        request = werkzeug.wrappers.Request(environ)
-        request.parameter_storage_class = werkzeug.datastructures.ImmutableDict
-        request.app = self
+        try:
+            httprequest = werkzeug.wrappers.Request(environ)
+            httprequest.parameter_storage_class = werkzeug.datastructures.ImmutableDict
+            httprequest.app = self
 
-        handler = self.find_handler(*(request.path.split('/')[1:]))
-
-        if not handler:
-            response = werkzeug.exceptions.NotFound()
-        else:
-            sid = request.cookies.get('sid')
+            sid = httprequest.cookies.get('sid')
             if not sid:
-                sid = request.args.get('sid')
+                sid = httprequest.args.get('sid')
 
             session_gc(self.session_store)
 
-            with session_context(request, self.session_store, self.session_lock, sid) as session:
-                result = handler(request)
+            with session_context(httprequest, self.session_store, self.session_lock, sid) as session:
+                request = self._build_request(httprequest)
+                db = request.db
+
+                if db:
+                    updated = openerp.modules.registry.RegistryManager.check_registry_signaling(db)
+                    if updated:
+                        with self.db_routers_lock:
+                            del self.db_routers[db]
+
+                with set_request(request):
+                    self.find_handler()
+                    result = request.dispatch()
+
+                if db:
+                    openerp.modules.registry.RegistryManager.signal_caches_change(db)
 
                 if isinstance(result, basestring):
                     headers=[('Content-Type', 'text/html; charset=utf-8'), ('Content-Length', len(result))]
@@ -610,7 +983,22 @@ class Root(object):
                 if hasattr(response, 'set_cookie'):
                     response.set_cookie('sid', session.sid)
 
-        return response(environ, start_response)
+                return response(environ, start_response)
+        except werkzeug.exceptions.HTTPException, e:
+            return e(environ, start_response)
+
+    def _build_request(self, httprequest):
+        if httprequest.args.get('jsonp'):
+            return JsonRequest(httprequest)
+
+        content = httprequest.stream.read()
+        import cStringIO
+        httprequest.stream = cStringIO.StringIO(content)
+        try:
+            simplejson.loads(content)
+            return JsonRequest(httprequest)
+        except:
+            return HttpRequest(httprequest)
 
     def load_addons(self):
         """ Load all addons from addons patch containg static files and
@@ -633,57 +1021,129 @@ class Root(object):
                         addons_manifest[module] = manifest
                         self.statics['/%s/static' % module] = path_static
 
-        for k, v in controllers_class_path.items():
-            if k not in controllers_object_path and hasattr(v[1], '_cp_path'):
-                o = v[1]()
-                controllers_object[v[0]] = o
-                controllers_object_path[k] = o
-                if hasattr(o, '_cp_path'):
-                    controllers_path[o._cp_path] = o
-
         app = werkzeug.wsgi.SharedDataMiddleware(self.dispatch, self.statics)
         self.dispatch = DisableCacheMiddleware(app)
 
-    def find_handler(self, *l):
+    def _build_router(self, db):
+        _logger.info("Generating routing configuration for database %s" % db)
+        routing_map = routing.Map()
+
+        def gen(modules, nodb_only):
+            for module in modules:
+                for v in controllers_per_module[module]:
+                    cls = v[1]
+
+                    subclasses = cls.__subclasses__()
+                    subclasses = [c for c in subclasses if c.__module__.split(".")[:2] == ["openerp", "addons"] and \
+                        cls.__module__.split(".")[2] in modules]
+                    if subclasses:
+                        name = "%s (extended by %s)" % (cls.__name__, ', '.join(sub.__name__ for sub in subclasses))
+                        cls = type(name, tuple(reversed(subclasses)), {})
+
+                    o = cls()
+                    members = inspect.getmembers(o)
+                    for mk, mv in members:
+                        if inspect.ismethod(mv) and getattr(mv, 'exposed', False) and \
+                                nodb_only == (getattr(mv, "auth", None) == "none"):
+                            function = (o.get_wrapped_method(mk), mv)
+                            for url in mv.routes:
+                                if getattr(mv, "combine", False):
+                                    url = os.path.join(o._cp_path, url)
+                                    if url.endswith("/") and len(url) > 1:
+                                        url = url[: -1]
+                                routing_map.add(routing.Rule(url, endpoint=function))
+
+        modules_set = set(controllers_per_module.keys())
+        modules_set -= set("web")
+        # building all none methods
+        gen(["web"] + sorted(modules_set), True)
+        if not db:
+            return routing_map
+
+        registry = openerp.modules.registry.RegistryManager.get(db)
+        with registry.cursor() as cr:
+            m = registry.get('ir.module.module')
+            ids = m.search(cr, openerp.SUPERUSER_ID, [('state','=','installed')])
+            installed = set([x['name'] for x in m.read(cr, 1, ids, ['name'])])
+            modules_set = modules_set.intersection(set(installed))
+        modules = ["web"] + sorted(modules_set)
+        # building all other methods
+        gen(["web"] + sorted(modules_set), False)
+
+        return routing_map
+
+    def get_db_router(self, db):
+        with self.db_routers_lock:
+            router = self.db_routers.get(db)
+        if not router:
+            router = self._build_router(db)
+            with self.db_routers_lock:
+                self.db_routers[db] = router
+        return router
+
+    def find_handler(self):
         """
         Tries to discover the controller handling the request for the path
         specified by the provided parameters
 
-        :param l: path sections to a controller or controller method
-        :returns: a callable matching the path sections, or ``None``
+        :param path: path to match
+        :returns: a callable matching the path sections
         :rtype: ``Controller | None``
         """
-        if l:
-            ps = '/' + '/'.join(filter(None, l))
-            method_name = 'index'
-            while ps:
-                c = controllers_path.get(ps)
-                if c:
-                    method = getattr(c, method_name, None)
-                    if method:
-                        exposed = getattr(method, 'exposed', False)
-                        method = c.get_wrapped_method(method_name)
-                        if exposed == 'json':
-                            _logger.debug("Dispatch json to %s %s %s", ps, c, method_name)
-                            def fct(_request):
-                                _req = JsonRequest(_request)
-                                with set_request(_req):
-                                    return request.dispatch(method)
-                            return fct
-                        elif exposed == 'http':
-                            _logger.debug("Dispatch http to %s %s %s", ps, c, method_name)
-                            def fct(_request):
-                                _req = HttpRequest(_request)
-                                with set_request(_req):
-                                    return request.dispatch(method)
-                            return fct
-                    if method_name != "index":
-                        method_name = "index"
-                        continue
-                ps, _slash, method_name = ps.rpartition('/')
-                if not ps and method_name:
-                    ps = '/'
-        return None
+        path = request.httprequest.path
+        urls = self.get_db_router(request.db).bind("")
+        matched, arguments = urls.match(path)
+        arguments = dict([(k, v) for k, v in arguments.items() if not k.startswith("_ignored_")])
+        func, original = matched
+
+        def nfunc(*args, **kwargs):
+            kwargs.update(arguments)
+            return func(*args, **kwargs)
+
+        request.func = nfunc
+        request.auth_method = getattr(original, "auth", "user")
+        request.func_request_type = original.exposed
+
+def db_list(force=False):
+    proxy = request.session.proxy("db")
+    dbs = proxy.list(force)
+    h = request.httprequest.environ['HTTP_HOST'].split(':')[0]
+    d = h.split('.')[0]
+    r = openerp.tools.config['dbfilter'].replace('%h', h).replace('%d', d)
+    dbs = [i for i in dbs if re.match(r, i)]
+    return dbs
+
+def db_monodb():
+    db = None
+
+    # 1 try the db in the url
+    db_url = request.params.get('db')
+    if db_url:
+        return db_url
+
+    try:
+        dbs = db_list()
+    except Exception:
+        # ignore access denied
+        dbs = []
+
+    # 2 use the database from the cookie if it's listable and still listed
+    cookie_db = request.httprequest.cookies.get('last_used_database')
+    if cookie_db in dbs:
+        db = cookie_db
+
+    # 3 use the first db
+    if dbs and not db:
+        db = dbs[0]
+    return db.lower() if db else db
+
+
+class JsonRpcController(Controller):
+
+    @route('/jsonrpc', type='json', auth="none")
+    def jsonrpc(self, service, method, args):
+        """ Method used by client APIs to contact OpenERP. """
+        return openerp.netsvc.dispatch_rpc(service, method, args)
 
 def wsgi_postload():
     openerp.wsgi.register_wsgi_handler(Root())
diff --git a/addons/web/session.py b/addons/web/session.py
deleted file mode 100644
index 65f5fdc2a62..00000000000
--- a/addons/web/session.py
+++ /dev/null
@@ -1,178 +0,0 @@
-import datetime
-import babel
-import dateutil.relativedelta
-import logging
-import time
-import traceback
-import sys
-
-import openerp
-
-_logger = logging.getLogger(__name__)
-
-#----------------------------------------------------------
-# OpenERPSession RPC openerp backend access
-#----------------------------------------------------------
-class AuthenticationError(Exception):
-    pass
-
-class SessionExpiredException(Exception):
-    pass
-
-class Service(object):
-    def __init__(self, session, service_name):
-        self.session = session
-        self.service_name = service_name
-
-    def __getattr__(self, method):
-        def proxy_method(*args):
-            result = self.session.send(self.service_name, method, *args)
-            return result
-        return proxy_method
-
-class Model(object):
-    def __init__(self, session, model):
-        self.session = session
-        self.model = model
-        self.proxy = self.session.proxy('object')
-
-    def __getattr__(self, method):
-        self.session.assert_valid()
-        def proxy(*args, **kw):
-            result = self.proxy.execute_kw(self.session._db, self.session._uid, self.session._password, self.model, method, args, kw)
-            # reorder read
-            if method == "read":
-                if isinstance(result, list) and len(result) > 0 and "id" in result[0]:
-                    index = {}
-                    for r in result:
-                        index[r['id']] = r
-                    result = [index[x] for x in args[0] if x in index]
-            return result
-        return proxy
-
-    def search_read(self, domain=None, fields=None, offset=0, limit=None, order=None, context=None):
-        record_ids = self.search(domain or [], offset, limit or False, order or False, context or {})
-        if not record_ids: return []
-        records = self.read(record_ids, fields or [], context or {})
-        return records
-
-class OpenERPSession(object):
-    """
-    An OpenERP RPC session, a given user can own multiple such sessions
-    in a web session.
-
-    .. attribute:: context
-
-        The session context, a ``dict``. Can be reloaded by calling
-        :meth:`openerpweb.openerpweb.OpenERPSession.get_context`
-
-    .. attribute:: domains_store
-
-        A ``dict`` matching domain keys to evaluable (but non-literal) domains.
-
-        Used to store references to non-literal domains which need to be
-        round-tripped to the client browser.
-    """
-    def __init__(self):
-        self._creation_time = time.time()
-        self._db = False
-        self._uid = False
-        self._login = False
-        self._password = False
-        self._suicide = False
-        self.context = {}
-        self.jsonp_requests = {}     # FIXME use a LRU
-
-    def send(self, service_name, method, *args):
-        return openerp.netsvc.dispatch_rpc(service_name, method, args)
-
-    def proxy(self, service):
-        return Service(self, service)
-
-    def bind(self, db, uid, login, password):
-        self._db = db
-        self._uid = uid
-        self._login = login
-        self._password = password
-
-    def authenticate(self, db, login, password, env=None):
-        uid = self.proxy('common').authenticate(db, login, password, env)
-        self.bind(db, uid, login, password)
-
-        if uid: self.get_context()
-        return uid
-
-    def assert_valid(self, force=False):
-        """
-        Ensures this session is valid (logged into the openerp server)
-        """
-        if self._uid and not force:
-            return
-        # TODO use authenticate instead of login
-        self._uid = self.proxy("common").login(self._db, self._login, self._password)
-        if not self._uid:
-            raise AuthenticationError("Authentication failure")
-
-    def ensure_valid(self):
-        if self._uid:
-            try:
-                self.assert_valid(True)
-            except Exception:
-                self._uid = None
-
-    def execute(self, model, func, *l, **d):
-        model = self.model(model)
-        r = getattr(model, func)(*l, **d)
-        return r
-
-    def exec_workflow(self, model, id, signal):
-        self.assert_valid()
-        r = self.proxy('object').exec_workflow(self._db, self._uid, self._password, model, signal, id)
-        return r
-
-    def model(self, model):
-        """ Get an RPC proxy for the object ``model``, bound to this session.
-
-        :param model: an OpenERP model name
-        :type model: str
-        :rtype: a model object
-        """
-        if self._db == False:
-            raise SessionExpiredException("Session expired")
-
-        return Model(self, model)
-
-    def get_context(self):
-        """ Re-initializes the current user's session context (based on
-        his preferences) by calling res.users.get_context() with the old
-        context
-
-        :returns: the new context
-        """
-        assert self._uid, "The user needs to be logged-in to initialize his context"
-        self.context = self.model('res.users').context_get() or {}
-        self.context['uid'] = self._uid
-        self._fix_lang(self.context)
-        return self.context
-
-    def _fix_lang(self, context):
-        """ OpenERP provides languages which may not make sense and/or may not
-        be understood by the web client's libraries.
-
-        Fix those here.
-
-        :param dict context: context to fix
-        """
-        lang = context['lang']
-
-        # inane OpenERP locale
-        if lang == 'ar_AR':
-            lang = 'ar'
-
-        # lang to lang_REGION (datejs only handles lang_REGION, no bare langs)
-        if lang in babel.core.LOCALE_ALIASES:
-            lang = babel.core.LOCALE_ALIASES[lang]
-
-        context['lang'] = lang or 'en_US'
-
-# vim:et:ts=4:sw=4: