add this to new branch for now
Merge branch 'master' into new-auth
Redid auth and sessions a bit.

- Authorization no longer happens in package.
- Less interfaces to implement.
* This means the stuff is hardcoded.