this may have broken things, adding sessioning, cookies, and user auth stubs