use db.json to initialize db instead of hardcoded
correctly set user name in session
introduce a better routing system

routes are configured in routes.json and http requests
are sent to the corresponding controller.
move custom middlewares to its own file
add 'unrestricted' settings to routes.json

and make sure that the middleware 'restrict' properly reacts