add auth helpers
extract session_id cookie of incoming request
add HTTP status codes 401, 403
re-think connection(s)/table(s); stub session management
basic session/cookie handling
add 400 status code