validated new session management, added secure logout, updated app.js to use app.controller(...) instead of keeping everything on the global context.