add controller function and view for user login/out (session control)
change layouts/app to disallow profile view link if user not logged in