add SessionsController and update routes