sessions controller and users model