Ask HN: Orin Kerr has a tech question, about network security

From the discussion that can be found here: http://www.volokh.com/2013/04/29/washington-post-on-united-states-v-auernheimer/

Can you point me to the best books or articles explaining that "you aren't supposed to use parameter-driven security, but are supposed to create user sessions and the like"? That would be helpful to read.

I've taken it upon myself to post Kerr's question here because:

# Many of the answers he's received are pretty shabby.

# I think HN ought to be interested in this case, and have knowledge of such books.

# Since networking is not one of my core skills, I'm fairly sure that someone else here can give better answers than I.

If you use Disqus, hold your nose and head on over there, or if not, post your answer here, and I will forward it. Please and thanks in advance.