Add session controller, spec and routes