force ssl on production
signin/signout and sessions framework
fix user routes