sessions controller and omniauth oauth