fixed sessions thing

well, it works. needs more error checking and auth