refactor sessions controller