Be more clear about that a session has a token, not just an id
Create sessions scoped on users
Two-factor authentication
Security page URL helper