if session is blank then assume, also need to make sure we rdir against the whole html dir
might still need a few more modifications to permissions after this