First pass at per-session authentication, not per loaded page