Added check for request to web root in bootstrap
Removed an empty line
Renamed Controller->requireAccess to Controller->requireAccessLevel
Renamed Session->sessionExpired to more descriptive isActive and reversed return values
Rejigged session handling

Session instantiation is now the responsibility of the bootstrap, which
passes it as a parameter to the Controller's processRequest method.
Addad type hinting to Bootstrap::display signature for clarity
Added protected internalRedirect method to Controller base class
Expanded Controller->internalRedirect to mirror index processing of url string
Added IndexController to handle requests to... well, the index.