added cookieless session tracking, and simple authentication