The current session setup works for a demo, but it's not secure or practical for running full time on a server.