gravatar / backend input validation / basic policies
mongo session store, user infor persists on refresh.
stuff