also assume that the valid credentials have been stolen and are being used by a hacker. make sure anything done in a session can be undone as part of sanitizin

also assume that the valid credentials have been stolen and are being used by a hacker. make sure anything done in a session can be undone as part of sanitizing the user