let add the session controller for every request except login