add User::find_by_credentials
add basic SessionsController