refactoring the sessions controller to make auth tokens better