birthdate and gender are now required, updated session controller
slightly, all specs passing