Build out SessionsController for API access

- Claim API nonces on #create
- Check session status via #show
- Remove current API Key via #destroy