SessionHandler now calls functions in the auth object for any interaction with user data beyond storing IDs in the session tables. The SessionHandler code does not need to know /anything/ about how user auth and storage is handled anymore.