added a sessions controller
handling invalid signup