added session controller; password hashing working now