refactored sessions controller for customer authentication