towards #10; define specific rewrites for _users and _session seems more secure.