Attempt session fetch in application route, use `redirect` hook in index

@sandersonet this fixes the test failure here: http://take.ms/pisgH

Fetching the session in the index route isn't problematic on its own, it's just
that the `signInAndVisit` helper stubs out `session.isAuthenticated`, so
the fetch will still fail in the test (the fetch itself isn't stubbed).

I moved the session fetch into the top-level application route, which is a parent
of all routes.