set session in beforeModel instead of setupController

@blanckien, thought I'd make this PR because this is kind of important to know:

`beforeModel` resolves before the model hook of child routes. This means that you can prevent a user from going into a `post.new` route for example if there is no session. `setupController` does not run before the `model` resolves for children routes, so if you were to go to the `posts.new` route and had logic in there to check for session and redirect if there was no session, it would redirect because that code would run BEFORE the session had resolved from `applicationRoute`. 

Let me know if you have any questions.