Sessions should expire after 30 minutes.
Login/logout. Tie sites to a user. #7 #8