Refactor authentication session tracking into separate Session model.