add default express-session properties
bugfix: require express, initialise app later
save user authentication data in local storage