NOTICKET: Refactor with sessions. Now holds auth on server