add sessions controller and secure authentication for owner