consistently access the logged-in user across views (and in templates)

[phil]

attaching to the session object seemed to upset sqlalchemy...