some comments regarding using sessions in non-cookie authentication strategies [ci skip]