Much simpler auth route—need to move session checks to game level…