add authentication for users and sessions controller
update authentication