add session fingerprinting (and fingerprint salt) and id string security; create util library to hold a number of functions that don't necessarily fit into an OO structure (at least, not without extra hassle and bending and obfuscation); clean up head.php to use the util functions