sessions work, oauth works, image upload works