finish up stuff with basic auth and sessions

Along with a bug fix to seshat@dev, this makes basic auth fully functional, hopefully.