session handling
broke up server.js into model, controller and routes