refactor user model and sessions controller