added session based user authenication for access to all pages that are not /userlogin, /createUser, and /loginError.