Router can just call navigate on itself
Don't redirect on AJAX request
Extract session storage to repo
Use prepared statements where possible
Actually delete session when requested