session and username stuff
switch callback to production