cleaned up session management code
added an access_code_required decorator