switching to RESTful session management