diff --git a/src/_h5ai/client/js/inc/boot.js b/src/_h5ai/client/js/inc/boot.js
index 4efaf837..9b3cbfc5 100644
--- a/src/_h5ai/client/js/inc/boot.js
+++ b/src/_h5ai/client/js/inc/boot.js
@@ -11,7 +11,7 @@ modulejs.define('boot', ['$'], function ($) {
     if (module === 'index') {
         href = '.';
     } else if (module === 'info') {
-        data.updateCachedSetup = true;
+        data.refresh = true;
         href = 'server/php/index.php';
     } else {
         return;
diff --git a/src/_h5ai/server/php/inc/class-bootstrap.php b/src/_h5ai/server/php/inc/class-bootstrap.php
index b633d895..1cd57785 100644
--- a/src/_h5ai/server/php/inc/class-bootstrap.php
+++ b/src/_h5ai/server/php/inc/class-bootstrap.php
@@ -19,18 +19,14 @@ class Bootstrap {
         date_default_timezone_set(@date_default_timezone_get());
         session_start();
 
-        $request_method = getenv('REQUEST_METHOD');
-        $request_uri = getenv('REQUEST_URI');
-        $script_name = getenv('SCRIPT_NAME');
-        $server_software = getenv('SERVER_SOFTWARE');
-
         $this->once('config');
 
+        $session = new Session($_SESSION);
         $request = new Request($_REQUEST);
-        $setup = new Setup($request->query_boolean('updateCachedSetup', false), $_ENV);
-        $app = new App($request, $setup);
+        $setup = new Setup($request->query_boolean('refresh', false));
+        $app = new App($session, $request, $setup);
 
-        if (strtolower(getenv('REQUEST_METHOD')) === 'post') {
+        if (strtolower($setup->get('REQUEST_METHOD')) === 'post') {
             (new Api($app))->apply();
         } else {
             // (new Page($app))->apply();
diff --git a/src/_h5ai/server/php/inc/core/class-api.php b/src/_h5ai/server/php/inc/core/class-api.php
index 03b03af5..32929e06 100644
--- a/src/_h5ai/server/php/inc/core/class-api.php
+++ b/src/_h5ai/server/php/inc/core/class-api.php
@@ -58,7 +58,7 @@ class Api {
 
         if ($this->request->query_boolean('setup', false)) {
 
-            $response['setup'] = $this->setup->to_jsono();
+            $response['setup'] = $this->setup->to_jsono($this->app->is_admin());
         }
 
         if ($this->request->query_boolean('theme', false)) {
diff --git a/src/_h5ai/server/php/inc/core/class-app.php b/src/_h5ai/server/php/inc/core/class-app.php
index d5166539..09804aa7 100644
--- a/src/_h5ai/server/php/inc/core/class-app.php
+++ b/src/_h5ai/server/php/inc/core/class-app.php
@@ -2,17 +2,25 @@
 
 class App {
 
+    const AS_ADMIN_SESSION_KEY = 'AS_ADMIN';
+
     private $request;
     private $setup;
     private $options;
 
-    public function __construct($request, $setup) {
+    public function __construct($session, $request, $setup) {
 
+        $this->session = $session;
         $this->request = $request;
         $this->setup = $setup;
         $this->options = Util::load_commented_json($this->setup->get('APP_PATH') . '/conf/options.json');
     }
 
+    public function get_session() {
+
+        return $this->session;
+    }
+
     public function get_request() {
 
         return $this->request;
@@ -40,19 +48,20 @@ class App {
 
     public function login_admin($pass) {
 
-        $key = $this->setup->get('AS_ADMIN_SESSION_KEY');
         $hash = $this->setup->get('PASSHASH');
-
-        $_SESSION[$key] = strcasecmp(hash('sha512', $pass), $hash) === 0;
-        return $_SESSION[$key];
+        $this->session->set(App::AS_ADMIN_SESSION_KEY, strcasecmp(hash('sha512', $pass), $hash) === 0);
+        return $this->session->get(App::AS_ADMIN_SESSION_KEY);
     }
 
     public function logout_admin() {
 
-        $key = $this->setup->get('AS_ADMIN_SESSION_KEY');
+        $this->session->set(App::AS_ADMIN_SESSION_KEY, false);
+        return $this->session->get(App::AS_ADMIN_SESSION_KEY);
+    }
 
-        $_SESSION[$key] = false;
-        return $_SESSION[$key];
+    public function is_admin() {
+
+        return $this->session->get(App::AS_ADMIN_SESSION_KEY);
     }
 
     public function to_href($path, $trailing_slash = true) {
diff --git a/src/_h5ai/server/php/inc/core/class-fallback.php b/src/_h5ai/server/php/inc/core/class-fallback.php
index fa55dae1..d8e93ddb 100644
--- a/src/_h5ai/server/php/inc/core/class-fallback.php
+++ b/src/_h5ai/server/php/inc/core/class-fallback.php
@@ -2,14 +2,18 @@
 
 class Fallback {
 
+    private $setup;
+    private $app;
+
     function __construct($app) {
 
+        $this->setup = $app->get_setup();
         $this->app = $app;
     }
 
     private function get_current_path() {
 
-        $uri_parts = parse_url(getenv('REQUEST_URI'));
+        $uri_parts = parse_url($this->setup->get('REQUEST_URI'));
         $current_href = Util::normalize_path($uri_parts['path'], true);
         $current_path = $this->app->to_path($current_href);
 
@@ -26,7 +30,7 @@ class Fallback {
             $path = $this->get_current_path();
         }
 
-        $app_href = $this->app->get_setup()->get('APP_HREF');
+        $app_href = $this->setup->get('APP_HREF');
 
         $cache = [];
         $folder = Item::get($this->app, $path, $cache);
diff --git a/src/_h5ai/server/php/inc/core/class-request.php b/src/_h5ai/server/php/inc/core/class-request.php
index d8d74f7f..2393f087 100644
--- a/src/_h5ai/server/php/inc/core/class-request.php
+++ b/src/_h5ai/server/php/inc/core/class-request.php
@@ -4,7 +4,7 @@ class Request {
 
     private $params;
 
-    public function __construct($params = null) {
+    public function __construct($params) {
 
         $this->params = $params;
     }
diff --git a/src/_h5ai/server/php/inc/core/class-session.php b/src/_h5ai/server/php/inc/core/class-session.php
new file mode 100644
index 00000000..42012b92
--- /dev/null
+++ b/src/_h5ai/server/php/inc/core/class-session.php
@@ -0,0 +1,24 @@
+<?php
+
+class Session {
+
+    private static $key_prefix = '__H5AI__';
+    private $store;
+
+    public function __construct(&$store) {
+
+        $this->store = &$store;
+    }
+
+    public function set($key, $value) {
+
+        $key = Session::$key_prefix . $key;
+        $this->store[$key] = $value;
+    }
+
+    public function get($key, $default = null) {
+
+        $key = Session::$key_prefix . $key;
+        return array_key_exists($key, $this->store) ? $this->store[$key] : $default;
+    }
+}
diff --git a/src/_h5ai/server/php/inc/core/class-setup.php b/src/_h5ai/server/php/inc/core/class-setup.php
index 9c227c4b..7577d587 100644
--- a/src/_h5ai/server/php/inc/core/class-setup.php
+++ b/src/_h5ai/server/php/inc/core/class-setup.php
@@ -3,32 +3,31 @@
 class Setup {
 
     const DEFAULT_PASSHASH = 'cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e';
-    const AS_ADMIN_SESSION_KEY = '__H5AI_AS_ADMIN__';
 
-    private $consts;
+    private $store;
 
-    public function __construct($update_cached_setup = false, $env = []) {
+    public function __construct($refresh = false) {
 
-        $this->consts = [];
-        $this->update_cached_setup = $update_cached_setup;
-        $this->env = $env;
+        $this->store = [];
+        $this->refresh = $refresh;
 
-        $this->setup_php();
-        $this->setup_app();
-        $this->setup_admin();
-        $this->setup_server();
-        $this->setup_paths();
-        $this->setup_cache();
-        $this->setup_cmds();
+        $this->add_globals_and_envs();
+        $this->add_php_checks();
+        $this->add_app_metadata();
+        $this->add_admin_check();
+        $this->add_server_metadata_and_check();
+        $this->add_paths();
+        $this->add_cache_paths_and_check();
+        $this->add_sys_cmd_checks();
     }
 
     private function set($key, $value) {
 
-        if (array_key_exists($key, $this->consts)) {
+        if (array_key_exists($key, $this->store)) {
             Logger::log('setup key already taken', [
                 'key' => $key,
                 'value' => $value,
-                'found' => $this->consts[$key]
+                'found' => $this->store[$key]
             ]);
             exit;
         }
@@ -40,23 +39,33 @@ class Setup {
             exit;
         }
 
-        $this->consts[$key] = $value;
+        $this->store[$key] = $value;
     }
 
     public function get($key) {
 
-        if (!array_key_exists($key, $this->consts)) {
+        if (!array_key_exists($key, $this->store)) {
             Logger::log('setup key not found', ['key' => $key]);
             exit;
         }
 
-        return $this->consts[$key];
+        return $this->store[$key];
     }
 
-    private function setup_php() {
+    private function add_globals_and_envs() {
 
         $this->set('PHP_VERSION', PHP_VERSION);
         $this->set('MIN_PHP_VERSION', MIN_PHP_VERSION);
+        $this->set('PASSHASH', PASSHASH);
+
+        $this->set('REQUEST_METHOD', getenv('REQUEST_METHOD'));
+        $this->set('REQUEST_URI', getenv('REQUEST_URI'));
+        $this->set('SCRIPT_NAME', getenv('SCRIPT_NAME'));
+        $this->set('SERVER_SOFTWARE', getenv('SERVER_SOFTWARE'));
+    }
+
+    private function add_php_checks() {
+
         $this->set('HAS_PHP_EXIF', function_exists('exif_thumbnail'));
 
         $has_php_jpeg = false;
@@ -67,41 +76,41 @@ class Setup {
         $this->set('HAS_PHP_JPEG', $has_php_jpeg);
     }
 
-    private function setup_app() {
+    private function add_app_metadata() {
 
         $this->set('NAME', '{{pkg.name}}');
         $this->set('VERSION', '{{pkg.version}}');
         $this->set('FILE_PREFIX', '_{{pkg.name}}');
     }
 
-    private function setup_admin() {
+    private function add_admin_check() {
 
-        $this->set('AS_ADMIN_SESSION_KEY', Setup::AS_ADMIN_SESSION_KEY);
-        $this->set('AS_ADMIN', isset($_SESSION[Setup::AS_ADMIN_SESSION_KEY]) && $_SESSION[Setup::AS_ADMIN_SESSION_KEY] === true);
-        $this->set('PASSHASH', PASSHASH);
         $this->set('HAS_CUSTOM_PASSHASH', strtolower(PASSHASH) === strtolower(Setup::DEFAULT_PASSHASH));
     }
 
-    private function setup_server() {
+    private function add_server_metadata_and_check() {
 
+        $server_software = $this->get('SERVER_SOFTWARE');
         $server_name = null;
         $server_version = null;
-        $server_software = getenv('SERVER_SOFTWARE');
+
         if ($server_software && preg_match('#^(.*?)(?:/(.*?))?(?: |$)#', strtolower($server_software), $matches)) {
             $server_name = $matches[1];
             $server_version = count($matches) > 2 ? $matches[2] : '';
         }
+
         $this->set('SERVER_NAME', $server_name);
         $this->set('SERVER_VERSION', $server_version);
         $this->set('HAS_SERVER', in_array($server_name, ['apache', 'lighttpd', 'nginx', 'cherokee']));
     }
 
-    private function setup_paths() {
+    private function add_paths() {
 
-        $script_name = getenv('SCRIPT_NAME');
+        $script_name = $this->get('SCRIPT_NAME');
         if ($this->get('SERVER_NAME') === 'lighttpd') {
             $script_name = preg_replace('#^.*?//#', '/', $script_name);
         }
+
         $this->set('APP_HREF', Util::normalize_path(dirname(dirname(dirname($script_name))), true));
         $this->set('APP_PATH', Util::normalize_path(dirname(dirname(dirname(dirname(dirname(__FILE__))))), false));
 
@@ -115,19 +124,19 @@ class Setup {
         $this->set('INDEX_HREF', $index_href);
     }
 
-    private function setup_cache() {
+    private function add_cache_paths_and_check() {
 
         $this->set('CACHE_HREF', Util::normalize_path($this->get('APP_HREF') . '/cache', true));
         $this->set('CACHE_PATH', Util::normalize_path($this->get('APP_PATH') . '/cache', false));
         $this->set('HAS_WRITABLE_CACHE', @is_writable($this->get('CACHE_PATH')));
     }
 
-    private function setup_cmds() {
+    private function add_sys_cmd_checks() {
 
-        $this->set('CMDS_PATH', Util::normalize_path($this->get('CACHE_PATH') . '/cmds.json', false));
+        $cmds_cache_path = Util::normalize_path($this->get('CACHE_PATH') . '/cmds.json', false);
 
-        $cmds = Util::load_commented_json($this->get('CMDS_PATH'));
-        if (sizeof($cmds) === 0 || $this->update_cached_setup) {
+        $cmds = Util::load_commented_json($cmds_cache_path);
+        if (sizeof($cmds) === 0 || $this->refresh) {
             $cmds['command'] = Util::exec_0('command -v command');
             $cmds['which'] = Util::exec_0('which which');
 
@@ -142,25 +151,24 @@ class Setup {
                 $cmds[$c] = ($cmd !== false) && Util::exec_0($cmd . ' ' . $c);
             }
 
-            Util::save_json($this->get('CMDS_PATH'), $cmds);
+            Util::save_json($cmds_cache_path, $cmds);
         }
         foreach ($cmds as $c => $has) {
             $this->set('HAS_CMD_' . strtoupper($c), $has);
         }
     }
 
-    public function to_jsono() {
+    public function to_jsono($as_admin = false) {
 
         $keys = [
             'APP_HREF',
             'ROOT_HREF',
             'VERSION',
 
-            'AS_ADMIN',
             'HAS_CUSTOM_PASSHASH'
         ];
 
-        if ($this->get('AS_ADMIN')) {
+        if ($as_admin) {
             $keys = array_merge($keys, [
                 'PHP_VERSION',
                 'MIN_PHP_VERSION',
@@ -184,7 +192,7 @@ class Setup {
             ]);
         }
 
-        $jsono = [];
+        $jsono = ['AS_ADMIN' => $as_admin];
         foreach ($keys as $key) {
             $jsono[$key] = $this->get($key);
         }
diff --git a/src/_h5ai/server/php/index.php b/src/_h5ai/server/php/index.php
index cbf2aca0..01d4a1e6 100644
--- a/src/_h5ai/server/php/index.php
+++ b/src/_h5ai/server/php/index.php
@@ -9,7 +9,7 @@ if (version_compare(PHP_VERSION, MIN_PHP_VERSION) < 0) {
 }
 
 $basepath = preg_replace('#[\\\\/]+#', '/', dirname(__FILE__));
-require_once($basepath . '/inc/class-bootstrap.php');
+require_once $basepath . '/inc/class-bootstrap.php';
 
 $bootstrap = new Bootstrap($basepath);
 $bootstrap->run();