Since I've not recieved response from Paul yet I have decided to try writting patch myself. I've just posted result on soaplite maillist.
At least it fixes worst problem with SOAP::Lite - ability to call any Perl subroutine on side of server.
Still there is no documented way to restict remote access to some methods in packages which objects should be remotly avialable. After looking into sources I see that undocumented handler on_dispatch could be used for this purpose.
