ideally, i'd avoid User information lookups on each request. I'd like to keep those to: login, logout, create accounts