had a surprisingly large fight to pass session data back and forth on login