Everything goes through the Miranda object. This is because the Miranda object knows to tell the rest of the cluster about things like new Sessions and new Events. This also makes for a cluttered Miranda class since it has to know about the details of lots of operations.
The solution, as I see it, is to create a temporary subsystem for each operation: an Operation class. An object capable of receiving messages is required, hence a subsystem, and it knows about the details of the operation, thus the Miranda class is less cluttered.
The first of these operations is the login operation. It is created when the Miranda object is asked to perform a login. It looks up the user and creates a session for them. If the user doesn't exist, then it signals this and terminates.