return 201 for session creation