changes to sessions_controller.rb