Protect routes with a decorator

sorts out session availability in templates
with tests
remove irrelevant comment