we'll need to think about where user session data will be stored - if it's above this level, then we'll need to accept user credentials here