refactored backend, added racer-access plugin for access control of data, stubbing out how sessions will eventually work when passport is plugged in