create sessions controller, tests for sign-in-out