removed sessions controller, replaced with user_api_keys controller