refactor session.js a little, addresses some of #460 but not all of it.