fixed controllers and frontend
fixed up api controllers for both session and api_key access