more modest improvements: don't let signed in users create new sessions/users