Extract session validation logic into its own method

Slightly changes the index page workflow to no longer
autovalidate the session, rather explicitly requiring
an index.validate_session() call. Also the session_invalid
logic has been extracted into its own method and expanded
(ui resources are still preloaded)

This simplifies/consolidates the page workflow. Tests
have been updated