actually began using the sessions in the api
got users working in a reasonable form

includes ability to create new user from login
to "visit" (user is created and visitor can see public content and
create private content)
privacy levels for content, although private by default and no ui to set
it yet