finish sessions and user delete routes