sessions controller and concerns