Hessian based remoting looks like a very nice and lightweight solution for many scenarios (e.g. even for webapplication 2 webapplication communication) but it seems like it has some limitations and it's not that easy to use, e.g. like the security issue.
However org.apache.cayenne.remote.* seems to have a few improvements to Hessian and even solve that security problem very nicely.
Would you please consider releasing that "generic" part of ROP (those nice improvements to hessian) as an independent library that would not depend on Cayenne, but only on Hessian?
I think many more projects could use it if that part would be independent.