Separate admin views from users.
Add secret-key to config.
Stringify _id in get-user.

When the session is stored in a cookie it must be serializeable.
ObjectId is not.
Use session cookie.
Merge pull request #13 from RyanMcG/cookie-session

Use Cookie session storage