create sessions, login/logout, and authorization flow