refactored sessions controller, some weird sign in behavior needs to be sorted out