Bastion: adding user-sessions controller and tests.