Cleaned API even more (everything is via HandlerFunc)
Sessions are now encrypted as well as signed.