rewrite the session system

rewrite identifying so that you have to call it explicitly, and from client land
(doesn't really make sense in the library)

introduce some new errors to enable the above features

more robust uid-finding for self