add user verification to sessions#new