Removed the session controller

Removed the session controller and made it so when creating a user there
is no authorization attempt. Any request other than user create requires
an athorization token.