More refactoring....

1. headers now in mbox[]
2. SS now AuthSession (complete)
3. sess now auth (complete)