Security fix

Now using sessions instead of cookies for authorization.