Pulled functionality out of the sessions controller. Now, what we have stored in the session is a user_session that contains the current user's permissions in the form of a hash. Also added a quick rspec test for the new User_session service.