Remove commented-out from session controller, add todo's for flashing log in/out