demos from SANS Sec660
postauth
session-handler