Seems like a reasonable first pass

It needs to be converted to use OAuth2 and possibly a smarter session store.

Best way to learn about it is to read the tests first.