Refactoring session handling. Using user credentials as session
identifier.