implement super basic anonymous user authentication (no email, no password, just tracking by session)