1. Remove unused methods 2. Remove unused and unnecessary features 3. Add basic tests The session token is stored server-side and never given to the client. A masked token is generated for each request which can be inserted into forms to be POSTed.
