add sessions controller and spec