routes and sessions controller