it's going to be messy either way. We have to 1) enforce state in the client, 2) enforce state on the server, or 3) both. For now I'm going to ignore session issues. Brain hurts.