use simple auth manager.
creates unidentified users on the fly.
remove authmanager
log in users and store sessions.