Rework Plugins

Note: Still preliminary, it's not at all ready for a merge. At the very least the history needs to be cleaned up.
it is really annoying that we need to add global session for all requests just because have added the Auth plugin. Might be nice if we do it in a way that we only add it to a special action only...and test it for that action alone. (Or do a better helper that always passes the right session in)