Completes session and user controllers.
Fixes autoselect for requests, and adds CSRF protection.
Completes ownership of cats and requests.
Adds flashing of error messages.
Adds some code for managing multiple sessions that doesn't work yet.