Added security to the monitoring calls - the calls to update a lesson now check that the user either the owner of the lesson or a staff member for the lesson.
Lessons return for monitoring include both the ones for the user in the staff group and all lessons created by the user. Otherwise it doesn't return lessons that were created by not yet assigned a class.
Fixed getAllLessons() to return all the lessons for which the user is in the lesson's staff group. Added organisationID to the basic lesson DTO returned to Flash.
Removed the "is this tool on the classpath" hack. Now it will throw a ToolException if a tool can't be fine. This will break one of our junit tests but the test will have to be skipped for the moment or rewritten to use a known set of tools.
Tweaking to reduce the number of times the User object is retrieved from the database. Also partially implemented the cache clear when a user object is changed.