initial work on making the favourites attach to the session not the user (so as not to require login)