move to app.rb, add session data