@with_session now passes session as last arg, not kwarg. If last arg
isn't an instance of SESSION, it is created and passed.