Improvements to auth and session code

[passiomatic]

Remove expired sessions

See reference session implementation in https://pypi.python.org/pypi/wsgistate/

Use a log in decorator to access certain views

Add something like @login_required to views