rollout authentication system, sessions controller remains