move sessions_controller.rb to API namespace
edge case for password lock screen: non-user creates question, different non-user views it