updated session controller to use bcrypt hashing