validate password before logging in
move session into own component
add session secret to app_config on staging
add new_session media type
add create_account function to helper.js