Authentication

Sessions are now a thing throughout the app.
is `legal_chars` a more accurate name for this?