Update sessions controller to use auth_token