updated app.js to include session service