Let's make sessions sane; never load in CLI context
We need PHP >= 5.5.4 for php_serialize
Implement session handler -- use files, but wipe instead of just unlink
Create CSRF class