add reasonable filters to sessions/users controller actions
handle if user logs in with name that doesn't exist
add root route