how about we just not trust users and use db session store?