`hash` is not really specific.

It's easier to use and set up than logrus, and the API is a bit nicer
(no distinction between a logger and a log entry, for example).

This way, failed authentication also has a request ID and such

If we're behing a proxy such as Caddy, the remote address will be that
of the proxy, so we have to use the X-Forwarded-For header that the
proxy injects instead.

This makes it easier to re-use the session after a while, and to
implement a logout option (by just deleting the session)

It fits the need more naturally.

This makes it easier to deploy the whole thing on FreeBSD

This makes it a bit easier to track things like permissions.

Makes it impossible to see which users have the same password.

... in a very rough fashion