New gh auth

final version of user login after resolving all merge conflicts. 
We don't need a flash notice. If the session is set, we know that we've been signed in