Use null_session (default value) with protect_from_forgery
Ability to seed users
Add name and role to users