added ability to change user handle
added required sesssion for most controller actions