I still wonder if these should be in our own table, or here, and how we invalidate them when the session dies...