Switched from popup login method to full page refresh, encrypted session id passed via GET, and some refactoring