I changed sessions to cookies. The only difference this make for our purposes is that now sessions work on the test server and on the development server (hopefully on the production server as well). I added an updatePassword method with tests and a allUsers method that returns all the users. In the future this should only be accessible to admin, but for the moment andyone can use it.
Merged updatePassword and allUsers with the master branch