basic session managment, should use an authentication filter for the purpose