Finished session auth framework for now. (fixes #1)

Doc changes and some implementations remain.