we haven't done this generically yet because there are so many methods of session/identity management