super hacky session -- you don't want to use session as in theory this
could be on more than one host, which is why i simply avoided it
altogether, ideally you do some form of cookie + server side validation