diff --git a/development.ini b/development.ini
index d8246e4..5ca6009 100644
--- a/development.ini
+++ b/development.ini
@@ -18,6 +18,9 @@ sqlalchemy.url = sqlite:///%(here)s/ordr3.sqlite
 
 retry.attempts = 3
 
+session.secret = "change me for production"
+session.auto_csrf = true
+
 # By default, the toolbar only appears for clients from IP addresses
 # '127.0.0.1' and '::1'.
 # debugtoolbar.hosts = 127.0.0.1 ::1
diff --git a/ordr3/__init__.py b/ordr3/__init__.py
index 484e80e..902597f 100644
--- a/ordr3/__init__.py
+++ b/ordr3/__init__.py
@@ -7,13 +7,32 @@ __version__ = "0.0.1"
 
 
 from pyramid.config import Configurator
+from pyramid.session import JSONSerializer, SignedCookieSessionFactory
 
 
 def main(global_config, **settings):
     """ This function returns a Pyramid WSGI application.
     """
     with Configurator(settings=settings) as config:
-        config.include("pyramid_jinja2")
+
+        session_factory = SignedCookieSessionFactory(
+            settings["session.secret"], serializer=JSONSerializer()
+        )
+        config.set_session_factory(session_factory)
+        config.set_default_csrf_options(
+            require_csrf=settings["session.auto_csrf"]
+        )
+
+        # config.set_root_factory(root_factory)
+
         config.include(".adapters")
+        #  config.include('.resources')
+        config.include(".routes")
+        # config.include('.security')
+        # config.include('.views')
+
+        config.include("pyramid_jinja2")
+
         config.scan()
-    return config.make_wsgi_app()
+
+        return config.make_wsgi_app()
diff --git a/ordr3/pshell.py b/ordr3/pshell.py
new file mode 100644
index 0000000..ae3ac61
--- /dev/null
+++ b/ordr3/pshell.py
@@ -0,0 +1,13 @@
+from . import models
+
+
+def setup(env):
+    request = env["request"]
+
+    # start a transaction
+    request.tm.begin()
+
+    # inject some vars into the shell builtins
+    env["tm"] = request.tm
+    env["dbsession"] = request.dbsession
+    env["models"] = models
diff --git a/ordr3/routes.py b/ordr3/routes.py
new file mode 100644
index 0000000..b5f03c7
--- /dev/null
+++ b/ordr3/routes.py
@@ -0,0 +1,2 @@
+def includeme(config):
+    config.add_static_view("static", "static", cache_max_age=3600)
diff --git a/ordr3/static/pyramid-16x16.png b/ordr3/static/pyramid-16x16.png
new file mode 100644
index 0000000..9792031
Binary files /dev/null and b/ordr3/static/pyramid-16x16.png differ
diff --git a/ordr3/static/pyramid.png b/ordr3/static/pyramid.png
new file mode 100644
index 0000000..4ab837b
Binary files /dev/null and b/ordr3/static/pyramid.png differ
diff --git a/ordr3/static/theme.css b/ordr3/static/theme.css
new file mode 100644
index 0000000..0f4b1a4
--- /dev/null
+++ b/ordr3/static/theme.css
@@ -0,0 +1,154 @@
+@import url(//fonts.googleapis.com/css?family=Open+Sans:300,400,600,700);
+body {
+  font-family: "Open Sans", "Helvetica Neue", Helvetica, Arial, sans-serif;
+  font-weight: 300;
+  color: #ffffff;
+  background: #bc2131;
+}
+h1,
+h2,
+h3,
+h4,
+h5,
+h6 {
+  font-family: "Open Sans", "Helvetica Neue", Helvetica, Arial, sans-serif;
+  font-weight: 300;
+}
+p {
+  font-weight: 300;
+}
+.font-normal {
+  font-weight: 400;
+}
+.font-semi-bold {
+  font-weight: 600;
+}
+.font-bold {
+  font-weight: 700;
+}
+.starter-template {
+  margin-top: 250px;
+}
+.starter-template .content {
+  margin-left: 10px;
+}
+.starter-template .content h1 {
+  margin-top: 10px;
+  font-size: 60px;
+}
+.starter-template .content h1 .smaller {
+  font-size: 40px;
+  color: #f2b7bd;
+}
+.starter-template .content .lead {
+  font-size: 25px;
+  color: #f2b7bd;
+}
+.starter-template .content .lead .font-normal {
+  color: #ffffff;
+}
+.starter-template .links {
+  float: right;
+  right: 0;
+  margin-top: 125px;
+}
+.starter-template .links ul {
+  display: block;
+  padding: 0;
+  margin: 0;
+}
+.starter-template .links ul li {
+  list-style: none;
+  display: inline;
+  margin: 0 10px;
+}
+.starter-template .links ul li:first-child {
+  margin-left: 0;
+}
+.starter-template .links ul li:last-child {
+  margin-right: 0;
+}
+.starter-template .links ul li.current-version {
+  color: #f2b7bd;
+  font-weight: 400;
+}
+.starter-template .links ul li a, a {
+  color: #f2b7bd;
+  text-decoration: underline;
+}
+.starter-template .links ul li a:hover, a:hover {
+  color: #ffffff;
+  text-decoration: underline;
+}
+.starter-template .links ul li .icon-muted {
+  color: #eb8b95;
+  margin-right: 5px;
+}
+.starter-template .links ul li:hover .icon-muted {
+  color: #ffffff;
+}
+.starter-template .copyright {
+  margin-top: 10px;
+  font-size: 0.9em;
+  color: #f2b7bd;
+  text-transform: lowercase;
+  float: right;
+  right: 0;
+}
+@media (max-width: 1199px) {
+  .starter-template .content h1 {
+    font-size: 45px;
+  }
+  .starter-template .content h1 .smaller {
+    font-size: 30px;
+  }
+  .starter-template .content .lead {
+    font-size: 20px;
+  }
+}
+@media (max-width: 991px) {
+  .starter-template {
+    margin-top: 0;
+  }
+  .starter-template .logo {
+    margin: 40px auto;
+  }
+  .starter-template .content {
+    margin-left: 0;
+    text-align: center;
+  }
+  .starter-template .content h1 {
+    margin-bottom: 20px;
+  }
+  .starter-template .links {
+    float: none;
+    text-align: center;
+    margin-top: 60px;
+  }
+  .starter-template .copyright {
+    float: none;
+    text-align: center;
+  }
+}
+@media (max-width: 767px) {
+  .starter-template .content h1 .smaller {
+    font-size: 25px;
+    display: block;
+  }
+  .starter-template .content .lead {
+    font-size: 16px;
+  }
+  .starter-template .links {
+    margin-top: 40px;
+  }
+  .starter-template .links ul li {
+    display: block;
+    margin: 0;
+  }
+  .starter-template .links ul li .icon-muted {
+    display: none;
+  }
+  .starter-template .copyright {
+    margin-top: 20px;
+  }
+}
diff --git a/production.ini b/production.ini
index a9bf657..93c0663 100644
--- a/production.ini
+++ b/production.ini
@@ -16,6 +16,9 @@ sqlalchemy.url = sqlite:///%(here)s/ordr3.sqlite
 
 retry.attempts = 3
 
+session.secret = "change me for production"
+session.auto_csrf = true
+
 [pshell]
 setup = ordr3.pshell.setup