Refactor security

TODO: Get security.js to check to see if express has the session
  middleware (no clue how)