copy over auth (needs review)
sign in form
sessions controller