factor out addroutes function for use by tests rather than repeating, use pyramid's built-in sessioning rather than beaker, use a sessionauthenticationpolicy rather than authtkt