Add more secure session handler

* switch to render pages as html
* Added content tags for JSON returns