Better handling of non-logged in user on the root

This is better than cursing the user for not having a session when they haven't
even had a chance to log in yet (hitting the root). Much better experience, and
helps becuase I am trying to limit the endpoints to the essentials, so no public
end points yet.