moved users and sessions to API