Session management works (for now), but only through a crappy cookie implementation.