refactor server session to object
consolidate sesssion lookup
store login ip in request
pass request to session
update sqrl_auth