[basex-talk] Webapp authentication flow – how do sessions work?