Moves session initializations to only places where a user is logged in

Prior to this PR, the session was being initialized on *every request* (lol, bad). For large-scale websites, this was causing horrible performance issues.

This fix moves the session initialization so it only happens in places where a user is logged in and happens "just in time."