refactored heavily to introduce factory for auth and session service. Further changes for #27 but blocked by CORS issue for now