user+session controller created