models/user, create_admin: fixing requires
controllers/session: don't create User model if user isn't logged in