rework authentication to use HMAC instead of unreliable cookies and session key checks