Currently the spec defines there is one endpoint instance per URI per VM. So the endpoint instance is application scoped.
Consider using one instance of an endpoint per client. This simplifies the threading model, but removes the ability of the developer to use the endpoint to share state that is common to multiple requests.
The developer needs to be able to hold application-wide state AND session state, so this is related to the issue of having a place to associate user data with the session.
The JAX-RS spec defines its endpoint instances to be request scoped by default, but this can be overridden so that they are application scoped to.
If we make the endpoint a CDI managed bean, then we can allow different modes.