Agreed.  Session code was copied from old login. My thinking is we're doing to rewrite it to be db based in a short order. I'll make the change for now.