Session backend

- [ ] Use a session instead of currentUser
- [ ] Verify against an actual backend