Refactor into small modules. No longer need POST /sesh because cookies can be set client-side.