Trying to flesh out user / session management with cross-site security (not there yet)