attempt to check in the changes that don't break authentication + some fixes
moved the userData into the session, under req.session.user, updated views