Add a generic error showing template and start by using it on the apperror page
Rewrite the way to use the session: remove the session_object base class and use the new keep_* functions instead
Discard the 'internal redirect'. It messes up with the navigation (URL and shown contents differ) and it's just not worth the trouble
Given the 2 changes above, rewrite the app loop in the index page. The HTTP redirects should not loop in the server anymore.