Remove some unused bits in index.php
Move session initialization into index.php

Hoisted session initialization up to application entry point. The
non-authenticated user path doesn't currently use sessions, but that's
ok.

Also beefed up the session destruction mechanism used in logout.