sid roughly implemented

The calls are all validated against the sid. For now it maps sid to
sessionId in the entity.