added users and sessions controller, changed user default of admin to false