add sessions controller, create and destroy
add log in, log out
redirect to user profile after log in