Fix up nits.
Store user by unique id, instead of holding the entire object in the session cookie.