remove global session object. each controller should just use the
session service
fix broken logout functionality

-logging out will now take you back to the login screen