refactor session handling code to have an explicit before and after handlers (run before and after site within requests, or the actual code within an eval)