use json gem
don't use sessions