Server-side sessions.

Closes #2