update app.js to demonstrate sessions

Adding a comment to point out to anyone using sessions (of whatever flavor) that they need to invoke them before invoking routes.