AuthController: disables itself unless sessions are active