Generate session_id on server, not client
Don't set up pointers to _sys.dir_users/comps in db_tables - we access them directly
Change HTTP method from GET to POST