switch to eventlet
don't keep going on bad login
don't let session cache data forever