Authentication

Sessions are now a thing throughout the app.
customary to tack on an `if session[:user_id]` to avoid an unnecessary database trip