Separated some sesh add/update logic. Fixed CSRF meta token. Added authentication for Sesh and Sports controllers.