add session controller and user authentication and password encryption