ssl only on two pages
added sessions controller subclass
added route to session controller
added use_https? method for controllers to override