login system needs to be reworked to not use session tokens. these should probably not be kept in sessions.