use rack session for authorization; safer when not using ssl connection