Method level. The request is a parameter for the method, so that would mean you could use it for multiple different requests. That includes possible different sessions as well. You don't want to check a session for a request you're not even handling at the time.