removed flask-login, added simpler session handling.  need to secure it next