Create separate Session class, add CSRF protection
Add Cart and an Item factory
Adding items to carts, flash messages