add Session model; generate api keys