while not relevant to this PR.. I think its about time we refactor out *log{in/out} to a sessions controller.