Password validation and new Sessions controller